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formulated  as  a  mixed-integer  program  (MIP),  but  unique  decomposition 
algorithms  are  developed  to  solve  the  problem  more  efficiently  than  standard 
branch  and  bound.  One  algorithm  is  essentially  Benders  decomposition  with 
special  integrality  cuts  for  the  master  problem.  A  second  algorithm  uses  a  new  set- 
covering  master  problem,  and  a  third  is  a  hybrid  of  the  first  two.  We  extend  our 
techniques  (/')  to  solve  general  system-interdiction  problems,  some  of  which  cannot 
be  formulated  as  MIPs,  (//')  to  solve  system-defense  problems  where  critical  system 
components  must  be  identified  and  hardened  against  interdiction,  and  (Hi)  to  solve 
interdiction  problems  with  uncertain  interdiction  success.  We  report 
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I.  INTRODUCTION 

This  doctoral  dissertation  investigates  what  we  call  "The  System  Interdiction 
Problem,"  (SI),  and  "The  System  Defense  Problem,"  (SD).  In  SI,  an  "adversary"  tries  to 
maximize  the  utility  of  his  system  (modeled  as  general  linear  or  integer  programs),  and 
an  "interdictor,"  with  limited  assets,  tries  to  minimize  that  maximum  by  limiting  the 
adversary's  feasible  actions,  or  by  increasing  the  cost  associated  with  his  activities.  As  in 
a  zero-sum  Static  Stackelberg  Game  (see  Simaan  and  Cruz,  1973,  for  the  definition  of 
Stackelberg  strategy),  we  assume  that  the  interdictor  {leader)  first  chooses  his  actions  and 
only  after  that  the  adversary  {follower)  decides  how  to  operate  the  system,  as  best 
possible,  given  the  effects  of  the  interdiction.  SD  extends  that  methodology  to  plan 
effective  "hardening"  (defense)  of  a  system  to  minimize  the  effects  of  subsequent 
interdiction.  In  SD,  the  players  change  sides:  The  leader  is  the  system  user  who  first 
chooses  his  defense  actions  and  only  then  the  interdictor,  now  the  follower,  chooses  his 
interdiction  plan. 

Throughout  this  work,  we  have  a  special  interest  in  the  problem  of  interdicting  (or 
defending)  a  road  or  other  transportation  network  in  order  to  maximize  the  post- 
interdiction  shortest-path  length  between  two  specified  nodes.  In  this  problem,  a 
"network  user"  wishes  to  traverse  a  path  of  minimum  length  (or  minimum  time, 
minimum  cost,  etc.)  between  two  specified  nodes,  5  and  /,  in  a  directed  network.  But,  by 
first  attacking  the  network  using  limited  resources,  an  interdictor  can  destroy  certain  arcs, 
or  increase  the  effective  length  of  certain  arcs,  and  thereby  increase  the  minimum  length 
in  the  a  priori  network. 


(a)  Maximizing  the  Shortest  Path  (MXSP)  is  the  interdictor's  max-min  problem: 
Subject  to  a  limited  interdiction  budget,  interdict  arcs  in  a  network  so  as  to 
maximize  the  shortest-path  length  between  nodes  s  and  t. 

(b)  Defending  the  Shortest  Path  (DSP)  is  the  network  user's  min-max-min  problem: 
Subject  to  a  limited  defense  budget,  harden  arcs  against  interdiction  so  as  to 
minimize  the  post-interdiction  shortest  path,  given  that  the  interdictor  will 
optimize  his  interdiction  plan  with  knowledge  of  which  arcs  are  hardened. 
Hardened  arcs  are  assumed  invulnerable. 

In  the  rest  of  this  chapter,  we  formulate  SI  and  SD  as  mathematical  programming 
problems,  and  motivate  some  new  approaches  for  solving  those  problems. 

A.         SYSTEM  INTERDICTION 

The  system  interdiction  problem  is  a  generalization  of  network  interdiction 
problems,  which  have  received  considerable  attention  over  the  years.  First  were  the 
military  applications,  like  interdiction  of  ground-forces  transportation  (e.g.,  Ghare, 
Montgomery  and  Turner  1971,  McMasters  and  Mustin  1970,  Golden  1978,  Fulkerson 
and  Harding  1977),  and  lately  drug  interdiction  efforts  have  triggered  more  research  (e.g., 
Wood  1993,  Washburn  and  Wood  1994).  Today,  military  and  civilian  systems  are 
becoming  even  more  complicated  and  interdependent,  so  interest  in  interdiction  of 
"general  systems"  arises,  too  (Chern  and  Lin  1995). 

The  system  interdiction  problem  is  a  model  for  the  following  scenario:  Two 
opposing  forces,  a  leader  (interdictor)  and  a  follower  (adversary),  are  involved  in  a 


warlike  conflict.  We  assume  that  the  follower  operates  a  "system,"  with  its  optimal 
operation  represented  adequately  by  the  solution  to  a  linear  program.  (Later  we  extend 
our  results  to  interdiction  of  systems  represented  by  more  general  optimization 
problems.)        Thus,     the    follower's    problem,     with    no    interdiction,     is     simply 

max{cry|/ly<b,0<y<u}where    c,y,ue$R",    b  E^Hm,A  eWm*n    and    cr    is  the 

transpose  of  the  column  vector  c  (we  assume  that  the  follower's  problem  is  feasible).  On 
the  other  hand,  the  interdictor  tries  to  minimize  the  follower's  objective  value  by 
preventing  the  use  of  some  of  the  follower's  possible  activities,  indexed  byy.    Let  the 

feasible  set  for  the  leader  be  X  =  |x  e{0,l}n|/?x  <  r|.  Xj  =1  means  that  activity  j  is 

interdicted  and  Rx  <  r  represents  the  restrictions  on  interdiction  resources  (we  assume 
that  X  is  not  empty). 

The  system  interdiction  problem  finds  the  optimal  interdiction  strategy  x*  for  the 
leader.  The  optimal  solution  for  the  follower  given  x*,  denoted  by  y*,  is  not  particularly 
important.  Two  special  instances  of  SI  are: 

(a)  Interdiction  of  a  max-flow  network  system  (e.g.,  Ghare,  Montgomery  and  Turner 
1971,  Wood  1993)  is  a  situation  where  the  follower  maximizes  flow  through  a 
capacitated  network,  while  the  leader,  with  limited  interdiction  resources,  can 
break  some  of  the  network's  arcs  (a  broken  arc  has  no  capacity),  and 

(b)  The  k-most-vital-arcs  problem  (Corely  and  Shaw  1982,  Malik  et  al.  1989)  is  a 
special  case  of  MXSP  where  the  interdictor  seeks  to  destroy  exactly  k  arcs  to 
interdict  the  network  most  effectively. 


Let  U  -  diag(u).  Then,  The  Linear  System-Interdiction  Problem  (LSIP)  is  defined 
to  be  the  following  leader's  problem: 

[LSIP]         min       max       cry 

xeX        yeF(x) 

where  X       =  {x  e  {0,1}"    Rx  <  rj,  and 

7(x)  =  {y|Ay<b,  0<y<*7(l-x)} 

The  follower  uses  activity  j  at  level  yy  By  interdicting  activity  j,  the  leader  changes  the 
upper  bound  on  yj  from  Uj  to  0,  i.e.,  forces  the  follower  to  accept  j,  =0  (we  assume  that 
7(x)  is  not  empty  for  all  feasible  xgX). 

Remark:  In  Appendix  B  we  show  that  [LSIP]  is  equivalent  to  a  more  general  system 
interdiction  problem  where  Y(x)  =  {y\Ay  +  Bx  <  b}  and  where  the  leader  can  change  the 

cost  of  the  follower's  activities  as  well.  This  general  case  allows  any  single  interdiction 
by  the  leader  to  affect  one  or  more  of  the  follower's  possible  activities  and  available 
resources.  For  instance,  in  MXSP,  one  interdiction  attempt  might  increase  the  length  of 
several  arcs  and/or  delete  one  or  more  nodes  from  the  network. 

Formulation  [LSIP]  is  a  structured  case  of  the  Bi-Level  Mixed  Integer 
Programming  Problem  (BLMlP).  (See  Ben-Ayed  1993  for  an  introduction  to  BLMIPs.) 
However,  the  general  BLMIP  does  not  assume  a  max-min  conflict  as  in  LSIP,  and  the 
objective  functions  of  the  leader  and  the  follower  may  have  much  in  common  in  the 
BLMIP,  rather  than  being  in  direct  opposition.  For  instance,  the  leader  and  follower  may 
represent  two  levels  of  decision  makers  in  the  same  company,  and  therefore  they  have 
similar,  although  not  identical,  goals. 
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In  Appendix  A  existing  algorithms  for  BLMTPs  are  explored,  and  it  is  shown  that 
none  of  those  algorithms  is  appropriate  for  large  instances  of  LSIP.  Some  of  the 
algorithms  (Bard  and  Moore  1992,  Wen  and  Yang  1990)  use  a  positive  approach,  which 
means  that  they  work  better  when  there  is  strong  correlation  between  the  leader's  and 
follower's  objective  functions.  Such  algorithms  are  likely  to  be  inefficient  when  applied 
to  max-min  problems  such  as  LSEP.  Two  other  BLMTP  algorithms  (Moore  and  Bard 
1990,  Vicente  et  al.  1996)  may  not  be  directly  positive,  but  they  rely  on  solving  bi-level 
linear  programs  (BLLPs)  which  are  nominally  solved  using  a  positive  approach.  In  fact, 
only  three  exact  algorithms  for  BLLPs  have  been  tested  on  relatively  large  problems 
(Bard  and  Moore  1990,  Hansen  et  al.  1992,  Judice  and  Faustino  1992),  and  all  of  these 
algorithms  use  a  positive  approach.  A  few  exact  algorithms  (Vaish  and  Shetty  1977, 
Anandalingam  and  Apprey  1991,  Onal,  1993)  use  what  appears  to  be  a  non-positive 
approach,  but  none  of  these  algorithms  have  been  tested  on  large  problems.  Finally,  we 
note  that  no  extant  algorithm  in  the  bi-level  arena,  exact  or  heuristic,  is  designed  to  take 
advantage  of  the  special  max-min  structure  of  LSIP,  or  the  special  shortest-path  structure 
ofMXSP. 


B.         REFORMULATION 

Formulation  [LSIP]  is  difficult  to  solve,  as  we  shall  see,  and  a  reformulation  is 
needed.    In  order  to  see  the  difficulties  with  [LSIP],  notice  first  that  being  able  to  solve 
[LSIP]  when  x  is  continuous  would  be  useful,  because: 
(a)        We  would  be  able  to  use  a  branch-and-bound  procedure  to  solve  [LSIP]. 


(b)  The  relaxed  problem  has  a  solution  at  an  extreme  point  of  the  convex  hull  of  X, 
C(X)  (Bazaraa,  et.  al.,  1993).  Hence,  if  we  relax  the  binary  constraints  x  e  {0,1}" 
so  that  0  <  x  <  1 ,  and  all  the  extreme  points  of  C(X)  happen  to  be  in  X,  then  we 
can  relax  the  binary  constraints  and  still  be  guaranteed  an  optimal  (binary) 
solution.  For  instance,  this  would  be  the  case  whenX=  {  x  e  {0,1}" ,  lx<  ro)  ). 

However,     solving    the     relaxed     problem    isn't    easy     in     general.         Let 
fi(x)  =  max  c  y  so  that  formulation  [LSIP]  is  equivalent  to  min  £  (x) .  When  we  relax 

the  binary  constraints  mX,  /x(x)  is  a  concave  function,  because  the  choice  of  x  changes 
only  the  right-hand  side  of  the  follower's  LP.  Hence,  we  may  have  local  optima.  In  fact, 
the  problem  [LSIP]  is  extremely  difficult  to  solve  and  even  the  relaxed  problem  is 
strongly  NP-hard  (Hansen,  Jaumard  and  Savard  1992). 

Example  1.1 

To  illustrate  the  "bad  behavior"  of  the  relaxation  of  [LSIP],  let  the  follower's 
problem  be  represented  by: 
[EX1] 


max 

y 

y\ 

+ 

yi 

s.t. 

y\ 

yi 

<5 
<5 

y\ 

- 

y-i 

<4 

-y\ 

+ 

yi 

<3 

y\ 

>0,   y2 

>o, 

The  system's  value  (without  any  interdiction)  is  10.   Assume  that  the  leader  can  interdict 


either  y\  or  y-i,  of  course,  he  wishes  to  minimize  the  maximum  value  of  yl  +  y2  after 
interdiction.  If  the  leader  interdicts  y\,  the  follower  solves 
[EXla] 


max 
y 

y\ 

+ 

yi 

St. 

y\ 

yi 

<o 

<5 

y\ 

- 

y* 

<4 

-y\ 

+ 

yi 

<3 

y\ 

> 

o,  y2 

>o, 

and  hence  obtains  a  value  of  3.  In  the  same  way,  if  the  leader  interdicts  y2,  the  value  of 
the  system  is  4.  In  this  simple  example,  the  optimal  solution  for  the  leader  is  to  interdict 
y\.  Now,  let's  see  what  happens  when  we  relax  the  binary  constraint  on  the  interdiction 
variables.  Let  y\  be  interdicted  by  1  -  p  and  y2  be  interdicted  by  p,  0  <  p  <  1 .  The 
parametric  problem  the  leader  solves  is: 
[EXlb] 


min  /j(p) 

0<^<l 

where  fx{p) 

=  max    y\  +  y2 

y 

s.t.        yi 

<5p 

yi 

<  5(1-/?) 

y\  -  yi 

<4 

-  yi  +   y2 

<3 

y\    ^0,   y2 

>o, 

and  fi(p)  has  a  global  minimum  at  p  =  0  and  a  local  minimum  at  p  =  1 .  (See  Figure 
1.1.)  ■ 
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Figure  1.1:  The  value  of  the  system  of  Example  1.1  as  a  function  of 
p,  as  given  by  formulation  [EX lb]. 


As  we  expect,  f(p)  in  Example  1.1  is  a  concave  function,  which  is  not  easy  to 
minimize.  In  order  to  overcome  this  problem,  we  reformulate  the  system-interdiction 
problem.  The  idea  is  to  leave  the  feasible  region  of  the  follower  independent  of  x  and, 
instead,  add  a  penalty  term  in  the  follower's  objective  function  for  any  use  of  interdicted 
activities.  The  new  formulation  is  convex,  for  continuous  x,  and  a  local  optimum  is  a 
global  optimum,  too. 

We  prove  in  Chapter  HI  that  there  exists  a  finite  penalty  multiplier  v  * ,  such  that 
for  all  v  >  v  *  the  following  is  equivalent  to  formulation  [LSIP]: 

[LSIP-1]     min      max       cry-xrVy 

xeX         yeY 

where  X    =  {x  e  {0,1}"  |  Rx  <  r] 

Y  =  [y  |  Ay  <  b,  0  <  y  <  u},      and 

V  =  diag(vl). 
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T  T 

Let  /2(x)  =  max{c  y  -  x  Vy}  so  that  [LSIP-1]  is  equivalent  to  min/2(x) .    The 

yeY  '  xeX 

equivalence  of  formulations  [LSIP]  and  [LSIP-1]  means  that  /2(x)  =  f^x)  for  all  x  eX, 
and  so  if  y(x)  Gargmax{c7y-xrFy},  then  xrVy  =  xry  =  0  and  /2(x)  =  cry(x)  is  not 

actually  a  function  of  v. 

Notice  that  when  we  relax  the  binary  constraints  in  X,  f2  (x)  is  a  convex  function, 
and  that  the  feasible  region  of  the  follower's  problem  is  independent  of  the  interdiction 
plan.     More  importantly,  from  basic  linear  programming  theory  we  can  reformulate 

[LSIP-1]  to  min{z  \z  >cry-xrVy  Vy  eY'}  where  Y'  is  the  set  of  extreme  points  of 

y={y|y4y<b,  0<y<u}.    This  suggests  solving  [LSIP-1]  with  a  row  generation 

algorithm,  which  is  essentially  Benders  Decomposition  (Benders  1962).  In  this 
algorithm,  the  inner  minimization  is  a  subproblem  that  generates  extreme  points  of  Y. 
The  master  problem  is  a  relaxation  of  [LSIP-1]  that  approximates  f{s),  from  below,  with 
cuts  constructed  from  those  extreme  points.  Actually,  this  algorithm  has  already  been 
developed  and  applied  to  the  max-flow  network-interdiction  problem  (Cormican  1995). 

Given  an  interdiction  plan  x  and  the  solution  y(x)  of  the  associated  subproblem, 

the  new  cut  in  the  master  problem,  z  >  c  y(x)  -  x  Vy(x),  will  be  "reasonably  tight,"  i.e., 
will  give  a  good  approximation  of  f2(x)  for  xgI,i^  £,if  we  have  a  valid,  but  small, 
penalty  multiplier  v.  For  instance,  in  the  max-flow  network  interdiction  case  v  =  1  is 
always  valid  and  gives  tight  cuts.  However,  in  another  system-interdiction  problem,  the 
minimum  valid  value  of  v  could  be  difficult  to  calculate.  A  "large  enough"  penalty  can 
be  easy  to  define — /2(0)  will  work  for  some  problems — but  such  a  penalty  can  be  much 


larger  than  necessary.  On  the  other  hand,  if  we  guess  and  we  guess  too  low,  we  might 
terminate  with  an  incorrect  solution  and  not  know  it  (see  Example  3.1  in  Chapter  ID).  If 
we  guess  and  we  guess  too  high,  the  running  time  of  the  decomposition  algorithm  will  be 
excessive,  due  to  the  loose  cuts. 

The  Benders  decomposition  algorithm  is  discussed  in  detail  in  Chapter  II  (for  the 
MXSP  scenario)  and  in  Chapter  HI  (for  more  general  system-interdiction  problems). 
We  also  develop  a  second  decomposition  algorithm,  which  is  a  variant  of  the  Benders 
decomposition  that  assumes  no  bound  on  the  penalty  multiplier  v  in  [LSIP-1],  and 
describe  a  hybrid  decomposition  algorithm  that  is  a  combination  of  the  first  two.  The 
second  and  third  algorithms  appear  to  be  superior  to  the  first  for  MXSP. 

Example  1.1  (revisited) 

We  can  reformulate  Example  1.1  in  the  form  of  [LSIP-1]  and  obtain  an 
equivalent  (for  p  =  0  and  p  =  l),  but  convex  formulation.  We'll  do  so  with  two 
penalties,  v  =  2  and  v  =  10,  to  show  the  difficulties  that  a  large  penalty  may  cause.  When 
we  relax  the  binary  constraints,  the  corresponding  parametric  linear  program  is: 

[EXlc]  min  f2{p) 

0<p<l 

where  f2(p)  =  max    yi  +  y2  -  v  ((l-p)  vi  +  py2) 
y 

s.t.     yi  <  5 

yi  <5 

yi  -    y2         <4 
-  y\  +   yi        ^3 
yx   >0,   y2   >0. 

As  can  be  seen  in  Figure  1.2,  for  both  values  of  v  the  solution  of  the  inner 
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maximization  problem,  as  a  function  ofp,  is  convex  and  matches  f2(p)  for  p  -  0  and 
p  -  1 .  However,  for  v  =  10,  the  relaxation  is  much  less  useful.  Assume  we  start  the 
decomposition  algorithm  we  mentioned  earlier,  with  p  -  0 .  The  two  cuts  the 
subproblem  would  produce,  for  v  -  2  and  v  =  10,  are  shown  in  the  graph.  The  cut  using 
v  =  2  gives  a  tighter  bound  on  f2(p)  for  p  =  1  and  clearly  that  difference  will  become 
more  significant  in  more  realistic  and  multi-dimensional  problems.   ■ 
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Figure   1.2:  Relaxation  of  different  formulations  for  Example   1.1.      The 

relaxation  using  formulation  [LSIP]  is  concave  while  the  relaxation  using 
formulation  [LSIP-1]  is  convex.  When  solving  formulation  [LSIP-1]  with 
Benders  decomposition,  the  cuts  in  the  master  problem  are  tighter  for  v  =  2 
compared  to  v  =  10. 
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C.         SYSTEM  DEFENSE 

The  system-defense  problem  is  a  natural  extension  of  the  system-interdiction 
problem.  When  a  system  user  expects  his  system  to  be  interdicted,  he  may  wish  to 
expend  resources  to  protect  that  system  to  mitigate  against  the  effects  of  interdiction. 
The  question  SD  addresses  is:  How  should  a  system  user  (now  also  called  the 
"defender"),  with  limited  resources,  "harden"  the  components  of  his  system  to  best 
protect  against  interdiction,  given  that  the  interdictor  will  optimize  his  interdiction  plan 
with  knowledge  of  those  improvements? 

Let   the   set   of  feasible   defense   plans   for   the   system   user  be   given   by 

G  =  {ge{0,l}n  |Hg<h}    (we  assume  that  G  is  not  empty).      We  assume  absolute 

protection  so  that  gk  =  1  implies  that  activity  j  is  fully  secured  against  interdiction.    SD 

finds  the  optimal  interdiction  strategy  for  the  system  user,  g*,  and  the  value  of  the  system 
associated  with  this  defense  plan.  Formally,  the  Linear  System-Defense  Problem  (LSDP) 
is  defined  as  the  following  problem  for  the  system  user: 

[LSDP]        max       min        max      cry 

geG        xeX(g)      yey(x) 

where  G         =  {g  e  {0,1} n  |  Hg  <  h} , 

X(g)     =[xe{0,l}n  |/ts<r,0<x<l-g},   and 
Y(x)     =  {y\Ay<b,  0  <  y  <  £7(1  -  x)}. 

[LSDP]  can  be  viewed  as  a  min-max  linear  system-interdiction  problem  where  the 
system  user  is  the  leader,  the  interdictor  is  the  follower,  and  for  every  feasible  defense 
plan  g,  the  associated  value  of  the  system  is  given  by  a  solution  to  a  system-interdiction 
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problem  where  the  protected  activities  are  invulnerable  (however  we  assume  that  X(g)  is 
not  empty  for  all  geG).  Thus,  in  SD  the  leader  interdicts  the  interdictor.  Notice  that  a 
linear  program  can  no  longer  represent  "the  system."  However,  when  the  defended 
system  is  represented  by  a  linear  program  (as  in  our  formulation  of  [LSDP]),  we  can 
solve  the  overall  system-defense  problem  through  a  nested  decomposition  algorithm, 
using  one  or  more  of  the  decomposition  algorithms  developed  for  [LSIP.] 

Example  1.1  (revisited) 

Assuming  that  the  system  user  can  protect  one  of  his  activities,  vi  or  y>2,  it  is  clear 
that  he  should  protect y\.  However,  in  more  complicated  problems,  devising  the  optimal 
defense  plan  is  much  more  difficult,  and  actually  the  system  defense  problem  is  NP-hard 
and  not  known  to  be  in  NP.  ■ 

D.         OUTLINE 

In  this  introduction,  we  have  defined  the  system-interdiction  problem,  which  is  a 
difficult-to-solve  bi-level  mixed-integer  programming  problem.  The  continuous 
relaxation  of  the  first  formulation  we  gave  for  LSIP  is  a  concave  function  in  the 
interdiction  variables,  so  even  the  relaxed  problem  is  difficult  to  solve.  Therefore,  we 
introduced  a  second  formulation  of  SI  that  is  equivalent  to  the  first  for  binary  interdiction 
decisions,  but  is  convex  when  we  relax  those  binary  constraints.  The  second  formulation 
uses  a  penalty  term  in  the  objective  function  that  prevents  the  follower  from  using 
interdicted  activities.  Unfortunately,  this  formulation  may  not  be  useful  if  a  valid, 
sufficiently  small  penalty  multiplier,  is  hard  to  find. 

In  Chapter  II  we  develop  three  decomposition  algorithms  for  solving  the 
problem  of  Maximizing  the  Shortest  Path  (MXSP)  in  a  directed  network.   Computational 
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results  for  those  three  algorithms  and  an  MIP  formulation  of  the  problem  are  provided, 
and  practical  techniques  to  speed  convergence  of  the  decomposition  schemes  are 
described  and  demonstrated. 

In  Chapter  in,  we  extend  the  models  and  methodology  of  Chapter  II  to  solve 
interdiction  problems  defined  on  systems  modeled  as  general  linear  or  integer  programs, 
not  just  networks.  We  use: 

(a)  A  decomposition  algorithm  that  is  based  on  a  finite  and  "good"  penalty  multiplier, 

(b)  A  decomposition  algorithm  that  assumes  no  finite  bound  on  the  multiplier,  or 

(c)  A  decomposition  algorithm  that  is  a  hybrid  of  first  two. 

In  Chapter  IV,  we  discuss  the  system-defense  problem,  and  solve  it  using  a 
nested  decomposition  algorithm.  Throughout  the  Chapter,  we  use  the  problem  of 
Defending  the  Shortest  Path  (DSP)  as  an  illustrative  example,  but  the  approach  and 
development  is  valid  for  general  SD  as  well.  Computational  results  for  DSP  are  given, 
and  practical  techniques  to  speed  convergence  of  the  nested  decomposition  schemes  are 
demonstrated. 

Finally,  Chapter  V  extends  our  approaches  further,  to  one  example  of  "stochastic 
system  interdiction,"  a  case  where  interdiction  successes  are  uncertain.  As  expected,  this 
problem  is  harder  to  solve  and  so  we  suggest  several  approximation  algorithms  that  are 
based  on  the  three  decomposition  algorithms  developed  earlier.  Preliminary 
computational  experience  is  reported  for  a  stochastic  shortest-path  network-interdiction 
problem,  but  the  suggested  algorithms  can  be  used  for  other  stochastic  system 
interdiction  problems,  too. 
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H.  SHORTEST-PATH  NETWORK  INTERDICTION 

Network-interdiction  problems  involve  two  opposing  forces,  a  leader  and  a 
follower,  who  are  engaged  in  a  warlike  conflict.  The  follower  operates  a  network  so  as  to 
optimize  his  objective  function  which  involves  moving  a  supply  convoy  through  the 
network  as  quickly  as  possible,  or  maximizing  the  amount  of  materiel  transported 
through  the  network  subject  to  capacity  constraints,  etc.  The  interdictor  tries  to  restrict 
the  follower's  achievable  objective  value  by  interdicting  (attacking)  arcs  so  as  to  destroy 
those  arcs  entirely,  or  increase  their  effective  length,  reduce  their  capacity,  etc.  The 
purpose  of  this  chapter  is  to  develop  new  models  and  solution  methods  for  the  problem  of 
interdicting  a  road  or  other  transportation  network  in  order  to  maximize  the  (post- 
interdiction)  shortest-path  length  between  two  specified  nodes. 

The  topic  of  network  interdiction  has  received  some  attention  over  the  years, 
initially  with  military  applications.  For  instance,  McMasters  and  Mustin  (1970)  and 
Ghare  et  al.  (1971)  develop  methods  for  interdicting  a  capacitated  supply  network  to 
hinder  the  movements  of  enemy  troops  and  materiel.  More  recently,  research  was 
triggered  by  drug  interdiction  efforts  (Wood  1993,  Washburn  and  Wood  1994)  and  by  the 
need  to  assess  the  vulnerability  of  information  networks  to  interdiction  (Grotschel  et  al. 
1992,  Medhi  1994). 

The  network-interdiction  problem  we  focus  on  is  Maximizing  the  Shortest  Path 
(MXSP)  (Fulkerson  and  Harding  1977,  Golden  1978).  In  this  problem,  a  "network  user," 
i.e.,  the  follower,  wishes  to  traverse  a  path  of  minimum  length  (or  minimum  time, 
minimum  cost,  etc.)  between  two  specified  nodes,  s  and  /,  in  a  directed  network.  But,  by 
first  attacking  the  network  using  limited  resources,  an  interdictor,  i.e.,  the  leader,  can 
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destroy  certain  arcs,  or  increase  the  effective  length  of  certain  arcs,  and  thereby  increase 
that  minimum  length.  MXSP  is  the  interdictor's  problem:  Subject  to  a  limited 
interdiction  budget  (and  possibly  other  restrictions),  interdict  arcs  in  a  network  so  as  to 
maximize  the  shortest-path  length  between  nodes  s  and  /. 

In  our  definition  of  MXSP,  arc  interdiction  involves  a  binary  decision  with  known 
resource  consumption  and  assured  success.  The  k-most-vital-arcs  problem  (Corely  and 
Shaw  1982,  Malik  et  al.  1989)  is  a  special  case  of  MXSP  where  the  interdictor  seeks  to 
destroy  exactly  k  arcs  to  interdict  the  network  most  effectively.  Since  that  problem  is 
NP-complete  (Ball  et  al.  1989),  it  follows  that  MXSP  is  NP-complete. 

The  &-most-vital-arcs  problem  has  received  limited  attention  and  we  are  not  aware 
of  effective  algorithms  for  solving  it.  Malik  et  al.  (1989)  suggest  a  potentially  effective 
algorithm  for  the  problem,  but  the  algorithm  has  a  theoretical  flaw  as  we  discuss  in 
Section  C.  Corely  and  Shaw  (1982)  suggest  an  algorithm  for  the  single-most-vital-arc 
problem  but  this  problem  is  a  very  simple  case  of  MXSP  which  is  solvable  in  polynomial 
time. 

Unlike  the  £-most-vital-arcs  problem,  MXSP  allows  general  resource  constraints 
which,  most  significantly,  enable  the  modeling  of  different  types  of  interdiction 
resources,  e.g.,  ground  troops,  aerial  sorties,  cruise  missiles,  etc.  Fulkerson  and  Harding 
(1977)  and  Golden  (1978)  have  studied  a  simpler  variant  of  MXSP  incorporating  a  single 
type  of  interdiction  resource  and  arc  lengths  that  increase  linearly  with  the  amount  of 
resource  applied.  We  believe  that  our  model  with  discrete  interdiction  variables  is  more 
realistic. 
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In  this  chapter,  we  first  show  how  to  model  MXSP  as  a  mixed-integer  program 
(MIP).  It  is  intuitively  clear,  and  later  demonstrated  by  computation,  that  this  MIP  can  be 
very  difficult  to  solve  directly  using  LP-based  (linear-programming-based)  branch  and 
bound.  Therefore,  we  devise  three  decomposition-based  algorithms  for  MXSP  and 
demonstrate  their  computational  effectiveness.  The  first  algorithm  implements  a  Benders 
decomposition  (Benders  1962)  that  solves  MXSP  much  like  Cormican  (1995)  solves  a 
maximum-flow  network-interdiction  problem .  This  technique  converges  slowly,  as  does 
branch  and  bound  applied  to  the  basic  MTP,  when  interdictions  cause  large  local  delays. 
The  second  decomposition  algorithm  does  not  suffer  as  much  from  this  problem.  That 
decomposition  (a)  simplifies  the  master  problem  of  the  first  algorithm  to  a  set-covering 
problem  (SCP),  (b)  improves  efficiency  by  incorporating  a  greedy  heuristic  for  the  SCP 
(in  addition  to  using  an  exact  algorithm),  and  (c)  exploits  the  special  structure  of  shortest- 
path  problems  to  gain  efficiency.  The  last  algorithm  we  devise  is  a  hybrid  of  the  first 
two. 

A.         THE  BASIC  MODEL:  MXSP  AS  A  MIXED-INTEGER  PROGRAM 

The  mathematical  programming  formulation  of  MXSP  on  a  directed  graph 
G=(Af,A)  is: 

Problem:         Maximize  the   shortest-path   length   in   a   directed   network  by 

interdicting  arcs. 
Indices:  /  e  N,  nodes  in  G  (s  is  the  source  node,  t  is  the  sink  node), 

k  e  A ,  arcs  in  G, 

k  g  FS(i)  (k  e  RS(i))  arcs  directed  out  of  (into)  node  i, 
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Data:  0  <  Ck  <  oo,  nominal  integer  length  of  arc  k, 

0  <  dk  <  qo,  added  integer  delay  if  arc  k  is  interdicted, 

r  vector  of  available  interdiction  resources, 

R  matrix  of  interdiction-to-resource  conversions, 

Variables:       Xk  =  1  if  arc  k  is  interdicted  by  the  leader;  else  Xk  =0, 
yic  =1  if  arc  A:  is  traversed  by  the  follower;  else  >>£  =0, 

Formulation: 


[MXSP  -  P]     max  min  ]T  (ck  +  xkdk  )yk 

xeX    y  *e.A  ' 


JbefS(i)        keRS(i) 


1  I  =  J 

0        ieN-s-t 
-1        i  =  f 
v^.^0     VA;g^. 


where  X  =  {xe  {0,1}|vA|  /&  <  r},  and: 


(a)  Node  s  is  the  source  node  and  t  is  the  terminal  node, 

(b)  The  set  of  arcs  directed  out  of  node  /  is  denoted  "FS(i)"  and  the  set  of  arcs 
directed  into  node  /  is  denoted  "RS(i)," 

(c)  Xk  =1  implies  arc  k  is  interdicted;  else  Xk  =0, 

(d)  Flow-balance  constraints  (1)  in  variables  y  route  one  unit  of  flow  from  s  to  t;  the 
inner  minimization  is  a  standard  shortest-path  model  with  arc  lengths  Ck  +  Xk  dk, 

(e)  Ck  is  the  nominal  length  of  arc  k  and  c*  +  dk  is  the  length  of  that  arc  if  it  is 
interdicted;  dk  is  finite  and  comprises  such  factors  as  repair  time  or  the  length  of  a 
local  detour  (the  case  of  dk  =  °°  is  dealt  with  later), 
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(f)  Rx  <  r  is  a  set  of  side  constraints  on  interdiction  resources;  thus,  X  represents  the 
set  of  feasible  interdiction  plans  (we  assume  that  X  is  not  empty), 

(g)  All  data  are  assumed  integral,  and  dk,  Ck  >  0  V  k  gA, 

(h)  All  solutions  will  be  assumed  to  be  integral  since  variables  x  are  required  to  be 
integral  and  extreme  points  of  the  inner  minimization  are  well  known  to  be 
integral. 

To  simplify  presentation,  and  without  loss  of  generality,  we  make  the  further  assumption: 

Assumption  2.1:  The  interdictor  has  insufficient  resources  to  disconnect  sfrom  t.  ■ 

This  assumption  is  innocuous  and  merely  simplifies  presentation  of  our  algorithms. 
All  of  the  algorithms  are  easily  modified  to  identify  the  degenerate  case  in  which  s  and  / 
can  be  disconnected.  The  extensions  of  our  techniques  to  handle  undirected  networks 
and/or  node  interdiction  are  also  straightforward. 

If  we  fix  x,  take  the  dual  of  the  inner  minimization  in  [MXSP-P],  make  a  few 
simple  modifications  and  then  release  x,  the  following  MO5  results: 
[MXSP-D]     z*=  max  ^t~ns 

X,7t 

s.  t.     tuj  -  7i t  -  dkxk  <ck     \/k  =  (ij)  e  A 
tts=0 
xeX 

Note  that  ns  =  0  may  be  assumed  because  the  inner  minimization  of  MXSP  has  at  least 
one  redundant  flow-balance  constraint  (as  do  all  network  flow  models  containing  a 
balance  constraint  for  each  node).  Also,  note  that  the  dual  variables  %  are  unconstrained 
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in  sign  and,  having  reversed  their  signs  compared  to  the  usual  convention,  we  may 
interpret  71,  as  the  post-interdiction  shortest-path  distance  from  s  to  /'. 

[MXSP-D]  is  essentially  the  model  explored  by  Fulkerson  and  Harding  (1977) 
and  by  Golden  (1978),  except  that  their  variables  x  are  continuous  and  only  a  single 
resource  constraint  is  allowed.  Thus,  that  model  is  a  simple  linear  program  (LP). 
Fulkerson  and  Harding  (1977)  suggest  solving  the  dual  of  that  LP  which  may  be 
interpreted  as  a  parametric  min-cost  flow  model.  This  approach  does  not  appear  to  be 
useful  when  we  relax  the  binary  constraints  in  [MXSP-D]  because  their  model  does  not 
allow  any  additional  constraints  such  as  x  <  1. 

In  theory,  we  can  solve  [MXSP-D]  using  a  standard  LP-based  branch-and-bound 
algorithm.  However,  especially  when  possible  delays  dk  are  large,  the  LP  relaxation  of 
the  model  is  weak  and  this  results  in  excessive  enumeration  and  unsatisfactory 
computation  times.  We  use  a  decomposition  approach  instead. 

B.         A  BASIC  DECOMPOSITION  ALGORITHM 

Our  basic  decomposition  algorithm  to  solve  MXSP  is  a  direct  application  of 
Benders  decomposition  to  [MXSP-P]  (or  [MXSP-D]  as  a  MTP,  e.g.,  Garfmkel  and 

Nemhauser  1972,  pp.  135-143).  Let  y  e{0,l}^  denote  an  arc-path  incidence  vector 
corresponding  to  an  s-t  path  P,  i.e.,  y^—l  implies  arc  k  is  in  P;  otherwise,  yk  =  0. 
z(y)=  ^ckyicls  tne  length  of  the  path  y.  Let  Y  denote  a  collection  of  arc-path 

keA 

incidence  vectors  corresponding  to  a  subset  of  all  simple  s-t  paths  in  G.  For  simplicity, 
we  refer  to  y  as  "a  path"  and  Y  as  "a  set  of  paths."  Also,  let  D  =  diag(d)  and  define: 
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[Master(f)-l] 


z$  -     max       z 

1  xeX 


s.t.        z<cTy  +  xTDy    Vyef 


[SP  -  Sub(x)]     zk  =  min  £  ick  +  **4t  )?* 


JfceFS(i)        /fcei?S(i) 


1        i  =  s 
0       ieN-s-t 
-1       i  =  / 

Let  7  denote  the  set  of  all  simple  s-t  paths.    For  fixed  x  =  £ ,  a  solution  to  the 
inner  minimization  of  [MXSP-P],  which  is  [SP-Sub(x)],  always  occurs  at  a  path  y. 

Therefore,  [Master(Y)-l]  is  equivalent  to  [MXSP-P]  when  Y  =  Y.  However,  we  hope  to 
solve  [MXSP-P],  at  least  approximately,  by  sequentially  generating  only  a  small  fraction 
of  the  extreme  points  of  7  in  a  decomposition  algorithm: 

Algorithm  1:  Basic  Benders  decomposition  algorithm  for  MXSP. 

Input:  An  instance  of  MXSP  and  allowable  optimality  gap  s. 

Output:       Interdiction  plan  x*  that  solves  MXSP  to  within  8  units  of  optimality. 

Step  0:         Y  <-  0,  z  < — oo,  z  <-  w,  i  <-  0. 

Step  1:         Solve  [SP-Sub(x)]  for  solution  y  with  objective  zi. 
Y  <r-Y  uy. 
If  z  <  zj  then  x'<—  £  and  z<r-z%. 

Step  2:         Solve  [Master(7)-1]  for  solution  £  with  objective  z^ 

Z      <—    Zy. 

Step  3:       If  z-z  >  e  then  go  to  Step  1 . 
Step  4:       x*  <—  x',  print  x*  and  stop. 
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The  correctness  of  the  algorithm,  as  in  any  Benders  decomposition  algorithm,  is 
based  on  the  following  observations: 

(a)  The  sub-problem  (which  is  simply  a  shortest-path  problem  here)  finds  an  optimal 
follower's  reaction  for  a  specific  leader's  interdiction  plan  £.  Hence,  z$  gives  a 
lower  bound  on  the  leader's  optimal  solution  value.  This  bound  is  finite  because 
of  Assumption  2.1. 

(b)  If  the  sub-problem  produces  the  same  s-t  path  twice,  the  upper  bound  and  the 
lower  bound  must  match  and  the  algorithm  terminates.  If  the  sub-problem 
continues  to  find  new  paths,  the  algorithm  must  converge  in  a  finite  number  of 
iterations  because  the  number  of  simple  s-t  paths  is  finite.  (The  number  of  paths 
and  thus  the  number  of  iterations  may  be  exponential,  however.) 

(c)  When  Y  includes  all  simple  s-t  paths,  [Master(7)-1]  is  clearly  equivalent  to 
[MXSP-P].  Otherwise,  when  7c7,  [Master(7)-1]  is  a  relaxation  of  [MXSP-P] 
and  thus,  Zf  is  an  upper  bound  on  the  interdictor's  optimal  objective  value.  Note: 

The  master  problem  constraints  defined  with  respect  to  Y  are  called  "Benders 
cuts." 

(d)  To  tighten  the  relaxation  of  [Master(7)-1],  we  next  introduce  "integrality  cuts." 

Proposition  2.1:  For  every  Benders  cut  z  <  c7y  +  xrZ)y,  the  integrality  cut  xry  >  1  is 
valid  whenever  z  >  c  y . 

Proof:  Note  that  each  such  Benders  cut  implies  that  z*  <  c  y  +  x*  Dy.    Furthermore, 
either  x*ry  =  0  or  x*ry  >  1.   If  x*Ty  =  0  given  that  z  >  cry,  then  z*  <  cry  +  x*TDy  = 
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cry  +  0  <  z,  which  is  a  contradiction.  Therefore,  x*7y  >  1  which  implies  that  xry  >  1  is  a 
valid  integrality  cut.  ■ 


Corollary  2.1:  For  every  Benders  cut  z  <  c  y  +  x  Dy,  the  integrality  cut  of  Proposition 

7*  y*.  •  7"  a  7*  ^  ^  •  7*  .a. 

2.1,  x  y  >  1,  can  be  tightened  to  x  y  >  2  if  z  >  c  y  +  mzx.dkyk ,  it  can  be  tightened  to  x  y 

k 

>  3  if  z  >  c  y  +  max  {  ck  yk+  die  yv  }5  an^  so  forth.  ■ 


Naturally,  as  z  is  updated  in  the  algorithm,  we  may  be  able  to  tighten  previously 
generated  integrality  cuts  using  Corollary  2.1,  too.  Actually,  in  our  implementation,  we 
add  the  cut  xry  >  1  even  if  z  =  cry  (or  xry  >  2  even  if  z  =  c7y  +  maxdkyk,  etc.).  If  the 

k 

optimal  solution  value  exceeds  the  current  value  of  z,  those  cuts  are  valid.  But,  if  those 
cuts  render  the  master  problem  infeasible,  the  algorithm  can  be  terminated  with  the 
incumbent  x'  being  optimal. 

We  also  improve  the  effectiveness  of  Algorithm  1  by  not  solving  the  master 
problem  to  optimality.  This  well-known  variant  of  Benders  decomposition  (e.g., 
Geoffrion  and  Graves  1974)  is  guaranteed  to  converge  as  long  as  every  sub-optimal 
integer  solution  y  satisfies  cTy  >  z  (recall  that  data  are  integral),  and  we  do  not  update  z 
unless  the  master  problem  is  solved  to  optimality. 

Since  all  dk  are  assumed  finite,  Algorithm  1  does  not  allow  the  interdictor  to 
completely  remove  (destroy)  an  arc.  To  model  the  effect  of  complete  arc  removal,  we 
can  solve  the  sub-problem  with  interdicted  arcs  eliminated,  while  in  the  master  problem 
we  may  be  able  to  define  a  "sufficiently  large"  artificial  delay  (say    \M  |max  \ck  )  on 

k 

every  interdictable  arc  to  keep  the  Benders  cut  valid.     But,  as  we  shall  demonstrate 
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empirically,  the  run  time  of  the  algorithm  grows  very  quickly  with  the  size  of  that  delay. 
On  the  other  hand,  being  too  conservative  with  that  artificial  delay  can  lead  to  difficulties 
as  seen  in  the  following  example. 

Example  2.1 

Consider  the  network  of  Figure  2.1  and  an  interdictor  who  can  remove  any  two 
arcs  from  that  network.  One  obvious  optimal  solution  to  MXSP  for  this  network  is  to 
interdict  (s,a)  and  (s,b)  so  that  the  shortest  s-t  path  has  length  20.  Now,  let  d  denote  the 
artificial  delay  that  is  to  be  added  to  interdicted  arcs  and  suppose  that  we  use  Algorithm 
1,  without  integrality  cuts,  to  solve  this  problem. 

Initially,  the  algorithm  finds  the  uninterdicted  shortest  path  s-a-t  with  length  2. 
Given  that  solution  for  the  follower,  the  leader  interdicts  (s,a)  and  (a,t)  and  the  "upper 
bound"  (as  calculated  in  Step  2)  is  2  +  2d,  which  is  valid  only  if  d  >  9.  In  the  next  step 
the  follower  finds  the  shortest  path  after  (s,a)  and  (a,t)  are  removed  from  the  network. 
The  solution  is  s-b-t,  with  length  12.  The  two  Benders  cuts  in  the  master  problem  are: 

z  <  2  +  dxsa  +  dxat        from  the  first  iteration,  and 

z  <  12  +  dxsb  +  dxbt      from  the  second  iteration. 


Figure  2.1:  Network  to  illustrate  difficulties  with  artificial  delays.  Numbers 
next  to  arcs  are  lengths. 
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There  are  four  cases  to  consider  now: 

(a)  If  d  <  5,  the  shortest  path  from  the  second  iteration  has  length  greater  the  pseudo- 
upper  bound  from  the  first  iteration.  We  conclude  then  that  d  is  too  small, 
increase  it  and  return  to  the  master  problem. 

(b)  If  5  <  d  <  10,  the  master  problem  objective  is  12.  Since  the  lower  bound  and 
pseudo-upper  bound  match,  the  algorithm  terminates,  but  with  an  incorrect 
solution.  In  this  case,  we  see  no  way  to  recognize  that  d  is  too  small  without 
solving  this  NP-complete  problem:  Does  there  exist  a  solution  to  MXSP  with 
objective  value  greater  than  z^l 

(c)  If  10  <  d  <  18,  the  master  problem  interdicts  both  paths  and  has  optimal  objective 
value  2+d.  The  third  iteration  of  the  sub-problem  finds  the  path  s-c-t  with  length 
20,  which  is  larger  than  the  current  pseudo-upper  bound.  Again,  we  conclude  that 
d  is  too  small,  increase  it  and  return  to  the  master  problem. 

(d)  If  d  >  18,  the  upper  bound  is  valid  and  the  algorithm  terminates  with  the  optimal 
solution.  ■ 

C.         A  SECOND  DECOMPOSITION  ALGORITHM 

Of  course,  case  (b)  of  Example  1  is  the  most  disturbing.  To  overcome  this 
difficulty,  we  offer  a  second  decomposition  algorithm.  This  algorithm  derives  from  the 
variant  of  Benders  decomposition  (mentioned  earlier)  in  which  the  master  problem  is 
solved  for  any  feasible  solution  with  objective  value  greater  than  the  current  lower  bound. 
The  algorithm  iterates  until  no  such  solution  exists;  at  that  point,  the  best  solution  found 
must  be  optimal.  For  simplicity,  we  now  assume  that  every  interdicted  arc  is  completely 
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removed  from  the  network.  No  loss  of  generality  arises  since  arcs  with  finite  delay  are 
easily  handled:  For  any  arc  k  with  dk<  <*>  and  nominal  length  Ck,  create  two  parallel  arcs, 
k\  and  k2.  Arc  k\  has  length  Ck  and  is  interdictable,  i.e.,  "removable."  Arc  k2  is  non- 
interdictable  and  has  length  ck+dk. 

The  master  problem  of  the  new  algorithm  simply  seeks  a  feasible  solution  with 

objective  greater  than  the  current  lower  bound,  z  =  maxcry . 

[Master(f)  -  2a]         Find      xgI 

s.t.         z<cTy  +  xTDy    Vys7 
z>z  +  \ 

(Note  that  z  >  z  +1  is  sufficient  since  all  data  are  assumed  to  be  integral.) 

Proposition  2.2:  For  artificial  delay  d  sufficiently  large,  x  is  feasible  to  [Master(Y)-2a] 

if  and  only  if*  interdicts  at  least  one  arc  in  every  path  represented  by  Y . 

Proof:  Sufficiency  is  guaranteed  because  c  y  >  0  and  d  is  large  enough  (we  can  assume 

d  >  2+1),  and  necessity  follows  because  z  =  maxc  y .  ■ 

yeY 

Instead  of  solving   [Master(F)-2a],   Proposition   2.2   allows  us  to  solve  the 
following  set  covering  problem  (SCP): 

[Master(7)  -  2b]         Find     xg! 

s.t.    yrx>l    Vyef 
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The  algorithm  we  have  just  established  is: 

Algorithm  2:  A  covering  decomposition  algorithm  for  MXSP. 

Input:  An  instance  of  MXSP. 

Output:       An  optimal  interdiction  plan  x*. 

Step  0:         Y  <r-0,z< qo,  z  <-  oo,  £  <-  0 

Step  1:         Solve  [SP-Sub(i)]  for  optimal  solution  y  with  objective  value  Zj. 
7<-fuy. 
If  z  <  z$  then  x'  <-  x  and  z  <—  z% . 

Step  2:        Attempt  to  solve  [Master(Y)-2b]  for  feasible  solution  x. 

If  [Master(Y)-2b]  is  feasible  then  go  to  Step  1. 
Step  3:        x*  <—  x',  print  x*  and  stop. 


Let  us  add  a  bit  of  insight  to  Algorithm  2.  Each  time  the  algorithm  reaches  Step 
1,  the  network  user  suggests  one  new  s-t  path,  the  best  with  respect  to  the  interdictor's 
previous  plan.  Then,  in  Step  2,  the  interdictor  tries  to  find  a  plan  that  interdicts  all  the  s-t 
paths  that  have  been  exposed  so  far,  paths  represented  by  Y .  This  new  interdiction  plan 
may  or  may  not  force  the  network  user  to  traverse  a  path  longer  than  the  current  lower 
bound.  Once  the  interdictor  fails  to  interdict  all  the  paths  in  Y,  he  knows  that  he  cannot 
force  a  shortest-path  length  that  is  longer  than  the  longest  path  in  Y.  But,  this  length  is 
exactly  the  current  value  of  z,  so  he  concludes  that  no  better  interdiction  plan  than  the 
incumbent  x'  exists,  and  the  algorithm  terminates. 

Algorithm   2    is   similar   to   the    algorithm   for   the   £-most-vital-arcs-problem 
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suggested  by  Malik  et  al.  (1989).  There,  paths  with  non-decreasing  lengths  in  the 
uninterdicted  network  are  enumerated  and  interdiction  is  attempted  until  the  /  shortest 
paths  cannot  be  feasibly  interdicted.  In  our  setting,  this  means  that  an  algorithm  that 
produces  the  /^-shortest  path  in  the  original  network  (e.g.,  Katoh  et  al.,  1982)  replaces 
Step  1.  However,  the  algorithm  in  Malik  et  al.  assumes  that  an  interdiction  plan  that 
interdicts  the  /  shortest  paths  must  correspond  to  a  cutset  in  the  sub-network  created  from 
the  union  of  the  arcs  and  nodes  from  those  paths.  Consequently,  a  solution  x* 
corresponds  to  a  minimum-cardinality  cutset,  which  can  be  identified  by  solving  a 
maximum-flow  problem  in  the  sub-network  using  arc  capacities  of  1.  But,  as  illustrated 
next,  the  assumption  is  invalid — the  master  problem  just  described  is  a  restriction  of  the 
correct  one — and  thus  that  procedure  must  be  viewed  as  a  heuristic. 

Example  2.2 

Consider  the  network  of  Figure  2.2,  with  all  arcs  of  length  1,  and  suppose  that  the 
interdictor  can  remove  any  two  arcs  from  the  network.  Clearly,  the  optimal  interdiction 
removes  arcs  (s,c)  and  (c,t)  and  forces  a  shortest  path  of  length  4.  But,  deleting  two  arcs 
crossing  any  cutset  leaves  a  shortest  path  of  length  2  or  3.  ■ 
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The  rest  of  this  section  describes  several  enhancements  to  Algorithm  2  to 
improve  efficiency. 

When  the  set  X  includes  only  a  single  resource  constraint,  say  rTx  <  ro,  we  can 
solve  the  following  master  problem  in  place  of  [Master(Y)-2b]: 


[Master(F)  -  2c 


min     rrx 


s.t.       yrx>l     VyeF 
xe{0A}W 

[Master(7)-2c]  is  a  standard  set-covering  problem  (SCP)  and,  if  it  has  an  optimal 
objective  value  less  than  or  equal  to  ro,  then  [Master(7)-2b]  is  feasible.  Of  course,  we 
need  not  solve  [Master(7)-2c]  to  optimality,  but  just  until  rrx  <  ro,  and  this  suggests  the 
use  of  efficient  heuristics.  We  use  a  version  of  the  simple  greedy  heuristic  for  SCPs 
discussed  by,  among  others,  Nemhauser  and  Wolsey  (1988,  pp.  466).  Many  other 
heuristics  exist,  (e.g.,  Beasley  1990,  Caprara  et  al.  1996),  but  this  one  is  easy  to 
implement  and  provides  more-than-adequate  performance  on  our  test  problems. 

Whenever  we  need  to  solve  a  master  problem  in  Algorithm  2,  we  run  the  greedy 
heuristic  on  [Master(7)-2c].  If  a  feasible  solution,  x  e  X,  is  found,  we  proceed  to  Step  1 
of  the  algorithm.  If  not,  only  then  do  we  resort  to  an  exact  (and  slower)  branch-and- 
bound  algorithm. 

When  solving  MXSP,  Algorithm  2  typically  iterates  much  faster  than  Algorithm 
1  because  the  master  problems  are  much  easier  to  solve.  This  is  true  even  when  potential 
delays  dk  are  small.  On  the  other  hand,  Algorithm  2  typically  requires  more  iterations 
than  Algorithm  1.  Another  problem  with  Algorithm  2  is  that  it  incorporates  no  upper 
bound,  and  thus,  it  cannot  be  stopped  early  with  a  near-optimal  solution.     To  help 
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overcome  these  two  difficulties,  we  employ  a  local-search  procedure.  With  this 
procedure,  we  can  add  more  than  one  path  to  Y  per  iteration,  and  we  can  often  determine 
an  upper  bound  on  the  optimal  solution  value. 

Let  z(y)  denote  the  length  of  path  y.  The  key  idea  behind  the  local  search  is  that 

any  path  y  with  z(y)  <  z  may  be  introduced  into  Y  without  compromising  validity  of  the 
algorithm.  This  is  true  by  definition  of  the  lower  bound.  There  are  many  ways  to  find 
more  than  one  s-t  path  per  iteration  and  we  use  the  following  procedure:  It  is  well  known 
that  finding  the  shortest  paths  from  s  to  all  other  nodes  is  not  much  more  difficult  than 
finding  a  shortest  s-t  path,  so  we  first  compute  the  former  paths  encoded  using  a  standard 
"shortest  path  tree"  and  "predecessor  function"  (e.g.,  Ahuja  et  al.  1993,  pp.  106-107).  Let 
P(t)=(s,  i\,  72,  ••  Jn,  t)  be  a  shortest  s-t  path  and  let  P(j)  be  a  shortest  path  to  nodey.  For 
every  node  im  e{/"i,  h,  •••  ,  in),  and  for  every  arc  (J,im)  in  the  network,  we  build  the  path 
(P(j),  im,  im+h  •••  ,  inj),  represented  by  its  incidence  vector  y,  and  calculate  the  path's 
length  z(y).  Hence,  the  procedure  Local_Search(7)  takes  a  shortest  path  tree  T  (derived 
from  a  shortest-path  algorithm)  as  input  and  returns  a  list  of  paths.  We  omit  pseudo-code 
for  this  procedure,  and  for  Procedures  Compare  and  Lift  described  below,  because  their 
implementations  are  straightforward  given  the  in-text  descriptions. 

Every  path  y  returned  from  Local_Search  with  z(y)  <  z  is  introduced  into  Y  as  one 
more  path  to  be  covered  in  the  master  problem.  If  z(y)  >  z  ,  the  path  is  stored  in  a  special 

set  Y  .   Later,  after  updating  z  in  succeeding  iterations,  we  move  any  y  e  Y    into  Y  if 

z(y)  <  z.  Based  on  Theorem  3  below,  the  paths  contained  in  Y  can  also  be  used  to 
obtain  an  upper  bound  z  on  z*  which  then  allows  us  to  solve  for  e-optimal  solutions. 
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Proposition  2.3:  Let  Y^  be  a  set  of  paths  such  that  z(y)  <  z  for  all  y  e  YI.    Then,  if 
[Master(  Y^  )-2b]  is  infeasible,  z*  <  z  . 

Proof:  If  z*  >  z,  we  can  feasibly  interdict  all  paths  y  such  that  z(y)  <  z  .  By  assumption 
we  cannot,  so  z*  <  z  .  ■ 

So,  if  we  define  the  set  %  =  fu  {y  e  Y    \  z(y)  <  z  +  8  }  and  [Master(  %  )-2b]  is 

infeasible,  we  know  that  z*  <z  +  z  and  the  solution  £  that  yielded  z  is  e-optimal. 

Our  implementation  of  Algorithm  2  uses  two  additional  procedures  that 
empirically  speed  convergence.  The  first  procedure,  Compare(Y),  returns  all  the  "non- 
dominated  paths"  in  Y .  Path  yi  dominates  path  y2  if  all  interdictable  arcs  in  y2  are  also 
contained  in  yi,  i  e .,  if  every  interdiction  plan  that  interdicts  yi  also  interdicts  £2. 
Essentially,  Compare  implements  one  type  of  test  for  "row  redundancy"  in  an  SCP. 
Other  redundancy  tests  are  known  (e.g.,  Garfinkel  and  Nemhauser  1972,  pp.  302-304, 
Taha  1975,  pp.  3 16-332)  but  this  one  is  easy  to  implement  and  has  proven  to  be  effective. 

The  second  procedure,  Lift(Y,  z),  uses  information  about  arcs  with  finite  delays  to 
tighten  the  SCP  formulation.  Recall  that  we  replace  each  arc  k  with  length  Ck  and  finite 
delay  du  with  two  parallel  arcs:  Interdictable  arc  k\  has  length  Ck  and  non-interdictable  arc 
£2  has  length  Ck  +  *&.  Now,  assume  that  we  have  a  path  y  in  Y,  such  that  y  includes  arc 
k\  and  dk  +  z(y)  <  z.  Then,  a  path  y  that  is  identical  to  y  except  that  it  includes  arc  k2 
instead  of  k\  is  longer,  but  is  still  shorter  than  the  lower  bound.  Hence,  y  can  be 
introduced  into  Y .  Actually,  this  new  path  dominates  y  and  can  replace  it,  and  we  have 
thereby  lifted  the  valid  inequality  y  x  >  1  to  y  x  >  1.  (This  is,  in  fact,  a  "lift"  since  y  < 
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y,  ykx  =  1  and  ykl  =0;  see,  for  example,  Nemhauser  and  Wolsey  1988,  pp.  261-267.)    The 

procedure  Lift(7,  z)  returns  the  set  of  non-dominated  paths  generated  from  Y  after  such 
replacements.  Notice  also  that  if  we  accept  s-optimal  solutions,  by  Proposition  2.3  we 
can  introduce y  into  Y  as  long  as  z(y  )  =  dt  +  z(y)  <  z  +  e.    That  is  done  by  procedure 

Lift(7,  z+s),  which  returns  the  set  of  non-dominated  paths  from  Y  with  z(y)  <z  +  z. 

Algorithm    2,    with    all    enhancements    is    outlined    below.        The    actual 
implementation  reorders  certain  computations  for  efficiency's  sake. 

Algorithm  2E:  The  covering  decomposition  of  Algorithm  2,  enhanced. 
Input:         An  instance  of  MXSP  and  optimality  tolerance  8. 
Output:       An  e-optimal  interdiction  plan  x*  for  MXSP. 

Step  0:         Y  <-  0,  Y  <-  0,  z  <-  -qo,  x  <r-  0. 

Step  1:         Solve  [SP-Sub(x)]  for  shortest  path  tree  T  and  objective  z$.  If  z  <  z$ 
then  x'<-  £,  z  <-  zit  Y  <-  Lift(7,  z  +  s). 

Step  2:        Y+<r-  Y+kj  Local_Search(7) 

r<-{y  e  Y+\  z(y)  <  z  +  s  },  Y+  <-  Y+-  V. 

Y'<r-  Lift(r ,  z  +  s). 
Y<r-  Compare(Y  u  Y'). 

Step  3:         Try  to  solve  [Master(7)-2b]  for  optimal  solution  x. 

If  [Master(7)-2b]  is  feasible,  then  go  to  Step  1. 
Step  4:         x*  <-x',  print  x*  and  stop. 
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It  should  be  noted  that  LocaI_Search  is  also  applicable  to  Algorithm  1.  In  fact, 
an  s-t  path  derived  by  any  means  generates  a  valid  Benders  cut  for  this  algorithm.  A  cut 
generated  from  an  arbitrary  path  may  be  dominated  if  it  contains  some  non-interdictable 
arcs,  or  if  the  path  contains  a  cycle.  Thus,  a  procedure  analogous  to  Compare  is  also 
applicable  to  Algorithm  1.  (Lift  does  not  apply.)  In  practice,  we  find  that  Algorithm  1 
with  these  modifications  requires  fewer  iterations,  but  total  solution  time  increases 
because  the  master  problems  quickly  become  large  and  hard  to  solve. 

D.         A  HYBRID  DECOMPOSITION  ALGORITHM 

The  final  algorithm  we  suggest  is  a  hybrid  decomposition  algorithm  that 
combines  the  master  problems  of  Algorithms  1  and  2.  In  this  hybrid  algorithm, 
Algorithm  3,  we  view  the  master  problem  of  Algorithm  1  as  the  "basic  master  problem" 
and  let  master  problem  constraints  of  Algorithm  2  serve  as  integrality  cuts  for  the  basic 
master  problem.  Thus,  the  master  problem  of  Algorithm  3  integrates  the  Benders  cuts, 
the  integrality  cuts  of  Algorithm  1  and  the  covering  cuts  of  Algorithm  2.  In  every 
iteration  we  add  to  the  basic  master  problem  one  Benders  cut,  one  integrality  cut,  and  we 
update  the  set  of  covering  constraints  in  this  master  problem  using  procedures 
LocaI_Search,  Compare  and  Lift. 

Example  2.3 

Consider  a  network  containing  s-t  paths  P\  and  P2,  among  others:  Pi  traverses  arcs 
1,  2  and  3  and  /^traverses  arcs  1,  4  and  5.  Those  arcs  have  the  following  parameters:  C\  = 
3,  C2  =  1,  C3  =  8,  C4  =  4,  C5  =  6,  d\  =3,  di  =  4,  d^  =  5,  d4  =  1,  and  d5  =  3.  Suppose  that  P\  is 
the  shortest  s-t  path  in  the  network,  and  hence  is  returned  by  the  sub-problem  in  the  first 
iteration  of  the  decomposition  algorithm.  Then,  the  Benders  cut  we  add  to  the  master 
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problem  is: 

Bendersi:  z  <  12  +  3xi  +  4x2  +  5x3. 

The  integrality  cut  and  the  covering  constraint  associated  with  this  Benders  cut 
are  identical: 

Integrality  1 :  x\  +  x2  +  X3  >  1 , 
Coveringi :  X\  +  X2  +  £3  >  1, 
both  with  "score"  12.  (Additional  cuts  that  might  be  generated  by  Local_Search  are 
ignored.)  The  score  is  the  uninterdicted  length  of  Pi;  this  value  is  important  for  later 
tightening  or  lifting  of  these  cuts.  Note  that  Compare  will  not  eliminate  one  of  these 
constraints,  nor  would  we  want  it  to:  A  lifted  integrality  cut  is  different  than  a  tightened 
covering  constraint  even  though  the  base  constraints  are  identical. 

Suppose  that  the  interdictor  has  enough  resource(s)  to  interdict  arcs  1,  2  and  3 
together,  and  this  is  the  solution  (with  z=24)  of  the  first  master  problem,  which  consists 
of  Bendersi,  Integrality  1  and  Coveringi.  Further,  assume  that  the  shortest  s-t  path  given 
these  interdictions  is  P2  so  that  z  =  c\  +  d\  +  c4  +  c$  =  16.  In  this  case  we  can  lift  the 
previous  covering  cut  because  interdiction  of  arc  1  alone  cannot  "push"  z  over  the  lower 
bound  z.  (Formally,  the  difference  between  the  score  of  Coveringi  and  z  exceeds  d\.)  The 
cuts  from  the  first  iteration  are  now: 

Bendersi:  z  <  12  +  3x\  +  4x2  +  5x3, 

Integrality  1:     x\  +  X2  +  x$  >  1,  Score  =  12, 

Coveringi:  x2+X3>  1,  Score  =15. 

The  score  of  Coveringi  has  been  updated  to  15,  which  is  the  length  of  Pi  with  arc  1 
interdicted.  (Note  that  we  could  also  have  lifted  the  basic  covering  cut  to  Xi  +  X3  >  1,  with 
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score  16.  In  our  implementation,  however,  we  are  satisfied  with  the  first  valid  lift  that  we 
find.) 

The  cuts  from  the  second  iteration  are: 

Benders2:  z  <\3  +  3xi+  lx4  +  3*5, 

Integrality2:      x\  +  x4  +  x5  >  1,  Score  =13, 

Covering2:  x4  +  X5  >  1,  Score  =16. 

(Again,  we  ignore  covering  cuts  potentially  derived  from  LocaI_Search.)  The  score  of 
Integrality2  is  the  uninterdicted  length  of  P2  while  the  score  of  Covering2  is  the  length  of 
P2  with  arc  1  (only)  interdicted.  Now,  suppose  that  the  solution  to  the  new  master 
problem,  which  consists  of  the  two  Benders,  two  integrality  and  two  covering  cuts,  is 
X]=  x3  =  x4  =  x5  =  1  and  x2  =  0.  Thus,  z=20  and  the  algorithm  continues. 

Suppose  then,  at  some  later  iteration,  z  increases  to  17.  In  this  case,  we  can 
tighten  the  right-hand  side  of  Integralityi  to  2,  because  to  push  z  over  z  we  must  interdict 
at  least  two  of  the  three  arcs  in  Pi.  (Formally,  the  difference  between  z  and  the  score  of 
Integralityi  exceeds  max^p  <&.)  We  can  also  lift  the  second  covering  cut,  because 

interdiction  of  arc  4  alone  cannot  push  z  over  z  —  17.     The  cuts  from  the  first  two 

iterations  are  now: 

Bendersi:  z  <  12  +  3xi  +  4x2  +  5x3, 

Integralityi:  xi+x2  +  x3>  2,                       Score  =  12, 

Coverings  x2  +  x3  >  1,                        Score  =  15, 

Benders2:  z  <  16  +  3*i  +  1*4  +  3*5, 

Integrality 2:  *i  +  x4  +  x5  >  1,                       Score  =  16, 

Covering2:  X5  >  1,                        Score  =17. 
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The  algorithm  may  or  may  not  halt  now  depending  on  the  other  cuts  that  have 
been  generated  and  the  value  of  z  obtained  after  solving  the  current  master  problem.  ■ 

In  practice,  when  using  a  single  interdiction  resource  constraint,  we  do  not  use 
Benders  cuts  in  early  iterations.  Instead,  we  heuristically  solve  the  set-covering  master 
problem  of  Algorithm  2  to  suggest  a  new  interdiction  plan,  as  long  as  this  is  easy  to  do. 
Once  the  covering  problem  becomes  difficult,  or  when  we  want  to  establish  or  update  an 
upper  bound,  we  solve  the  complete,  hybrid  master  problem.  If  the  problem  is  infeasible, 
or  the  value  of  the  objective  function  (the  new  value  of  upper  bound)  matches  the  value 
of  the  lower  bound,  we  are  done.  Otherwise,  we  proceed  with  the  algorithm  using  the 
solution  from  the  hybrid  master  problem. 

E.         COMPUTATIONAL  EXPERIENCE 

We  use  a  set  of  random  problems  here  to  test  the  algorithms  we  have  constructed. 
Several  network  structures  are  used,  specified  as  follows: 

(a)  There  is  one  source  node  5  and  one  sink  node  t. 

(b)  There  are  mxn  "inner  nodes,"  arranged  in  a  grid  of  m  rows  and  n  columns. 

(c)  There  is  an  arc  from  s  to  all  (inner)  nodes  in  the  first  column,  and  there  is  an  arc 
from  all  (inner)  nodes  in  the  last  column  to  t.  None  of  these  2m  arcs  may  be 
interdicted. 

(d)  An  arc  exists  from  each  node  in  row  r  and  column  c,  i.e.,  in  grid  position  (r,c)  to 
the  nodes  in  positions  (r+l,c),  (r-l,c),  (r,c+l),  (r+\,c+l)  and  (r-l,c+l),  assuming 
that  nodes  exist  in  these  positions.  All  of  these  arcs  are  interdictable.   Figure  2.3 
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gives  an  example  of  a  test  network  with  9  =  3x3  inner  nodes, 
(e)        The  basic  data  for  each  network  is: 

1)  m  and  n, 

2)  the  identity  of  interdictable  arcs:  the  total  number  of  potentially 
interdictable  arcs  is  a  =  (n  -  2)(5/w  -  4)  +  3/w  -  2,  but  only  a  specified 
percentage  p  of  the  a  arcs  are  chosen  to  be  interdictable.  Interdictable  arcs 
are  chosen  at  random;  and 

3)  ro,  the  total  interdiction  resource  available.  (We  assume  single  type  of 
interdiction  resource.) 


■►    Cannot  be  interdicted 
-►    Potentially  interdictable 


Figure  2.3:  Example  of  a  3x3  network  for  computational  tests. 


(f)         The  randomly  generated,  integer  data  for  arc  k  are: 

1)  Ck,  uniformly  distributed  on  [\,c], 

2)  when  k    is  identified  as  interdictable:  dk,  uniformly  distributed  on  [\,d], 
and 

3)  when  k  is  identified  as  interdictable:  rk,  uniformly  distributed  on  [!,/•]. 
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Our  algorithms  are  programmed  in  C  using  the  CPLEX  version  5.0  callable 
library  (ILOG  1997)  for  exact  solution  of  master  problems,  when  needed.  CPLEX  is  also 
used  to  solve  [MXSP-D]  directly.  Default  solver  options  are  used  except  that  "variable 
selection  strategy"  is  set  to  "branch  based  on  pseudo  reduced  cost"  when  solving  the 
master  problem  in  any  of  the  decomposition  algorithms.  All  computation  is  performed 
on  an  IBM  RS-6000  model  590  computer  with  512  megabytes  of  RAM.  All  running 
times  displayed  are  averages  across  ten  networks  of  identical  topology,  but  with  different 
random  arc  attributes. 

Note  that  in  Algorithms  1  and  3,  we  do  not  solve  the  master  problem  to 
optimality,  but  rather  for  a  feasible  integer  solution  £  that  yields  z  >  z.  Experience 
indicates  that,  when  the  master  problem  becomes  difficult,  it  is  best  to  stop  with  the  first 
such  incumbent  solution.  On  the  other  hand,  the  first  incumbent  does  not  usually 
generate  a  "good"  cut  in  early  iterations.  Our  implementation  exploits  this  experience 
using  a  simple  rule:  If  we  have  not  solved  the  master  problem  to  optimality  in  three 
seconds,  we  stop  if  the  incumbent  has  z  >  z,  or  else  we  continue  until  we  find  such  an 
incumbent  or  until  the  master  problem  is  proven  infeasible. 

Table  1  shows  results  for  problems  1-4.  Overall,  Algorithm  3  has  the  best 
running  times  and  can  be  40  times  faster  than  solving  [MXSP-D]  directly  by  branch  and 
bound.  Algorithm  2  is  fastest  for  smaller  instances  (but  without  upper  bound 
information  during  execution).  Algorithm  1  is  the  slowest  of  the  four  procedures.  We 
would  like  to  emphasize  a  few  points: 
(a)        Varying  arc  attributes  while  holding  the  network  topology  and  algorithm  fixed 

can   lead  to  widely   varying   solution  times:    Compare   means   and   standard 
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deviations  for  the  running  times.  In  the  larger  networks,  the  fastest  run  (among 
the  10  different  runs)  may  be  100  times  faster  than  the  slowest.  We  are  still 
investigating  ways  to  reduce  the  running  times  of  the  longer-running  problems. 


[MXSP-D] 

Algorithm  1 

Algorithm  2E 

Algorithm  3 

Problem 

ro 

To         So 

Tj       S,      N,      P, 

T2 

S2      N2       P2 

T3        S3      N3 

P3 

1 

20 

107       77 

110      115      51     102 

2 

1      21          320 

2        1      20 

315 

2 

30 

978    1215 

(6)       - 

25 

18      36          690 

33      36      36 

630 

3 

40 

(7) 

_ 

650 

560      57        1205 

220    185      51 

1220 

4 

50 

- 

-         -        -        - 

(5) 

-        -         - 

(7)      - 

- 

Table  2.1:  Computational  results  for  a  network  with  100=10x  10  inner  nodes  (a=396),  p=100%,  c=10,  d=\0 
and  r=5.  The  numbers  in  parentheses  represent  the  number  of  problems  solved  to  optimality,  out  of  10 
cases,  within  3600  CPU  seconds. 

Legend:        Th  -Run  time  in  CPU  seconds  for  Algorithm  h. 

(0  =  branch-and-bound  on  [MXSP-D],  2=2E) 
S>h  -  Standard  deviation  in  CPU  seconds  of  Th 
N/,  -  Number  of  iterations  for  Algorithm  h. 
PA  -  Number  of  constraints  in  the  master  problem  when  the  algorithm  h  terminates. 


(b)  All  the  algorithms  are  very  sensitive  to  ro,  the  total  available  interdiction  resource. 
Running  time  typically  increases  rapidly  as  ro  increases  from  a  small  value  but 
then  starts  decreasing  for  sufficiently  large  values,  beyond  those  displayed  here. 
(Variations  in  run  times  occur  with  changes  in  other  data,  but  the  basic  trend 
remains.)  This  makes  sense  since  increasing  interdiction  resource  allows  more 
combinations  of  arcs  to  be  interdicted,  up  to  a  point,  but  then  for  sufficiently  large 
r0,  all  or  nearly  all  arcs  can  be  interdicted,  and  the  problem  becomes  relatively 
easy. 
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(c)  In  all  problem  instances,  all  of  the  algorithms  find  good  solutions  quickly:  Most 
of  the  running  time  is  spent  proving,  or  trying  to  prove,  optimality. 

(d)  Table  2.2  displays  results  from  runs  designed  to  explore  the  sensitivity  of  the 
algorithms  to  network  shape.  The  decomposition  algorithms  prefer  "tall 
networks,"  like  the  12x8  network,  over  "long  networks"  like  the  7x14  network. 
This  tendency  may  result  from  the  greater  number  of  paths  in  a  long  network,  the 
potentially  greater  number  of  constraints  in  the  corresponding  master  problems, 
and  because  there  is  a  positive  correlation  between  the  number  of  potential 
constraints  and  the  actual  number  needed  to  generate  a  tight  master  problem. 
However,  when  not  all  of  the  arcs  are  interdictable  (problems  8  and  9),  the 
decomposition  algorithms  handle  long  networks  quite  well  (perhaps  because  there 
are  fewer  potential  constraints  in  the  master  problem).  Branch-and-bound  for 
[MXSP-D]  seems  to  perform  better  on  long  networks. 


[MXSP-D] 

Algorithm  2E 

Algorithm  3 

Problem 

m*n 

a 

P 

To       So 

T2 

S2       N2 

P2 

T3 

S3        N3        P3 

5 

12x8 

370 

100% 

415      665 

1 

1        18 

195 

1 

1         18      240 

6 

8x12 

382 

100% 

350      375 

140 

130        45 

1075 

100 

70        43     1125 

7 

7x14 

405 

100% 

182     210 

(8) 

- 

(8) 

-          -          - 

8 

10x20 

876 

50% 

98      135 

30 

51        40 

495 

58 

83        38      535 

9 

10x40 

1796 

25% 

85      140 

20 

24        55 

400 

62 

90        52      480 

Table  2.2:  Computational  results  for  networks  with  different  network  shapes,  with  r0=25,  c=10,  d=\0 
and  r=5.  The  total  number  of  potentially  interdictable  arcs  is  a  and  the  percentage  of  interdictable  arcs 
from  a  is  p.  See  Table  1  for  other  definitions. 
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It  may  be  possible  to  improve  computation  times  substantially  by  settling  for  a 
slightly  less-than-optimal  solution.  So,  we  next  repeat  the  tests  on  particularly  difficult 
problems,  problems  3,  4  and  7,  but  allow  a  5%  optimality  gap.  Results  are  displayed  in 
Table  2.3.  (Optimality  gaps  were  described  previously  in  absolute  terms.  Here,  an 
allowable  gap  of  g%  means  100(z-z)/z  <  g.)  Indeed,  run  times  can  be  significantly 
shortened. 


[MXSP-D] 

Algorithm  2E 

Algorithm  3 

Problem 

To         So 

T2        S2      N2      P2 

T3 

S3      N3       P3 

3 

850      810 

233      183     43     1070 

114 

77     40      1075 

4 

(7) 

(7) 

960 

815      56      1620 

7 

48        37 

(9) 

112 

127     41      1770 

Table  2.3:  Computational  tests  on  problems  from  Tables  1  and  2  with  a  5%  optimality  gap  allowed.  See 
Table  l's  legend  for  definitions. 


In  Table  2.4  we  compare  the  algorithms  for  the  case  in  which  an  interdicted  arc  is 
actually  removed  from  the  network.  We  fix  the  cost  of  interdiction  to  one  unit  of 
resource  per  arc,  so  we  are  actually  solving  the  £-most-vital-arcs  problem  for  £=5  and 
k=\0  in  7x7,  10x10  and  14x14  networks.  Note  that  for  standard  branch  and  bound 
solving  [MXSP-D]  and  for  Algorithm  1,  we  use  artificial  delays  of  d=5  and  d=\0. 
However,  d=5  is  often  too  small  and  yields  incorrect  solutions  while  d=\0  results  in  long 
run  times.  Branch  and  bound  is  the  slowest  algorithm  on  these  problems,  and  Algorithm 
2  is  the  fastest  by  a  substantial  margin.  Results  for  Algorithm  3  are  omitted  since  that 
algorithm  is  slower  than  Algorithm  2.  (We  can  view  Algorithm  3  as  Algorithm  2  with 
Benders  cuts  added  in  the  master  problem.    But,  these  cuts  are  weak  for  large  d,  do  not 
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add  much  information  to  Algorithm  2's  master  problem  and  mostly  serve  to  hinder 
solutions.)  The  table  demonstrates  the  sensitivity  of  run  times  to  network  size  and  k. 


Problem 

k 

m*n 

a 

[MXSP-D1 

Algorithm  1 

Alg.  2E 

d=5              d=\0 

d=5              d=\0 

8 

5 

7x7 

188 

2.6         [7] 

20.3 

1.3        [7] 

2.8 

0.2 

9 

10 

7x7 

188 

70.4         [4] 

(5) 

46.6         [5] 

180.1 

3.5 

10 

5 

10x10 

396 

28.0         [6] 

155.6 

4.9         [6] 

14.9 

0.4 

11 

10 

10x10 

396 

1334.0        [5] 

(0) 

137.8         [6] 

960.2 

21.3 

12 

5 

14x14 

860 

103.7         [9] 

1353.0 

14.6         [9] 

43.7 

1.7 

Table  2.4:  Results  for  the  fc-most-vital-arcs  problems.  Numbers  in  parentheses  are  the  number  of  problems 
solved,  in  10  trials,  within  3600  CPU  seconds  (each).  In  the  columns  under  d=5,  numbers  in  brackets  are 
the  number  of  problem  solved  correctly,  out  of  the  10  trials.  Numbers  not  in  parentheses  or  brackets  in  the 
"algorithm  columns"  are  CPU  seconds  averaged  over  10  trials. 

Legend:  k  -  Number  of  arcs  the  interdictor  may  interdict 
(Every  arc  is  potentially  interdictable.) 
d  -  Artificial  delay.  (Other  data  as  in  Tables  1-3.) 


F. 


CONCLUSIONS 


This  chapter  has  discussed  a  shortest-path  network-interdiction  problem,  MXSP, 
on  a  directed  network.  The  objective  of  "the  interdictor"  is  to  attack  (interdict)  network 
arcs,  using  limited  resources,  so  as  to  maximize  the  length  of  a  shortest  path  between  two 
specified  nodes.  Interdiction  of  an  arc  increases  its  effective  length,  or  destroys  the  arc 
making  it  impassable.  The  ultimate  purpose  of  the  interdiction  is  to  slow  the  movement 
of  the  "network  user"  through  a  road  or  other  transportation  network. 
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MXSP  is  an  NP-complete,  max-min  problem.  We  show  how  to  formulate  the 
problem  as  a  mixed-integer  program  (MIP)  but  develop  decomposition  techniques  that 
typically  solve  test  problems  much  more  efficiently  than  does  LP-based  branch  and 
bound  with  the  MIP.  Our  first  technique  applies  Benders  decomposition  with  a  standard 
master  problem  and  shortest-path  sub-problems,  but  the  second  decomposition  uses  a 
unique  set-covering  master  problem.  A  third  decomposition  algorithm  is  a  hybrid  of  the 
first  two.  Special  techniques,  including  integrality  cuts  for  the  master  problem  and  local 
search  to  generate  more  than  one  Benders  cut  per  iteration,  significantly  improve 
efficiency  over  naive  implementations  of  the  decompositions.  Numerous  avenues  are 
open  for  further  research.  These  are  discussed  in  Chapter  VI,  Conclusions. 

It  is  clear  that  our  techniques  may  be  generalized  to  "system  interdiction 
problems,"  as  we  shall  demonstrate  in  next  chapter.  Later,  we  use  these  generalizations 
to  solve  a  "system-defense  problem,"  in  particular,  the  problem  of  hardening  a  road 
network  against  attack;  see  Chapter  IV.  The  issue  of  uncertainty  in  interdiction  success 
for  MXSP  is  discussed  in  Chapter  V. 
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HL  THE  SYSTEM-INTERDICTION  PROBLEM 

The  mathematical  study  of  interdiction  has,  until  now,  focused  on  "network 
interdiction"  in  which  an  enemy's  supply  lines,  modeled  as  a  network,  are  efficiently 
disrupted  by  attacking  network  components,  e.g.,  bridges,  roads,  rail  lines,  etc.  The 
purpose  of  this  chapter  is  to  generalize  the  network-interdiction  techniques  of  Chapter  II 
to  handle  the  interdiction  of  general  systems,  for  instance,  a  segment  of  an  economy  that 
is  producing  war  materiel. 

Our  basic  system-interdiction  model  assumes  that  the  interdictor  makes  resource- 
constrained,  binary  interdiction  decisions  to  attack  a  system  whose  optimal  operation  is 
modeled  through  a  mixed-integer  linear  program.  We  suggest  solving  this  model  using 
extensions  of  the  three  decomposition  algorithms  developed  in  Chapter  EL  We  then 
extend  those  three  decomposition  algorithms  even  further,  to  solve  a  more  general 
system-interdiction  problem,  where  the  optimal  system  operation  is  modeled  through  an 
even  more  general  optimization  problem. 

A.         WHEN  SYSTEM  OPERATION  CAN  BE  MODELED  WITH  A  MIXED 
INTEGER  (LINEAR)  PROGRAM 

In  this  section,  we  assume  that  the  optimal  solution  of  the  follower's  system  can 
be  adequately  modeled  through  the  optimization  of  an  MIP.  Let  U  =  diag(u).  Then,  the 
Mixed-Integer  Linear  System-Interdiction  Problem  (MDLSIP)  is  defined  to  be  the 
following  leader's  problem: 
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[MILSIP]  z*     =    min    ^(x)        where  /^x)  is  defined  by 

xeX 

[M-Sub(x)-1]        /i(x)=  max    cry 

yer(x) 

and         X       =  {xe{OJL}n  |  Rx  <  rj, 

7(x)  ={y\Ay<b,0<y<Ua-x),yGYINT}, 

where   c,y,  ueSR",   c,be9?m,    /4e9?wxw   and    YINT   represents  integer  (or  binary) 

restrictions  on  none,  some  or  all  of  the  variables  y.   With  the  exception  of  the  set  YINr, 

formulation  [MILSIP]  is  equivalent  to  formulation  [LSIP],  described  in  Chapter  I. 
Thus,  Xj  =  1  means  that  activity  j  is  interdicted,  and  that  changes  the  upper  bound  onjy, 
from  Uj  to  0.  For  notational  simplicity,  this  model  assumes  that  every  activity  is 
potentially  interdictable  but,  in  practice,  certain  activities  will  be  off-limits,  inaccessible 
or  otherwise  unavailable  for  interdiction.  A  more  significant  assumption  for  modeling 
purposes  is: 

Assumption  3.1:  The  set  X  is  not  empty  and  the  inner  maximization  is  feasible  for  every 
interdiction  plan  x.  ■ 

One  can  imagine  more  complicated  problems  where  the  interdictor's  actions 
affect  more  than  one  activity  at  a  time,  or  where  those  actions  change  the  costs  of  the 
follower's  activities  or  his  available  resources.  The  following  proposition  shows  that 
[MILSIP]  can  be  modified  to  handle  such  situations. 
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Proposition  3.1:  Let 

[MILSIP-1]  min      max     cry-xrVy 

xeX      yey(x) 

where  X     ={ie {Oi}"  | Rx  <  r],  and 

Y(x)  =  {y<=Xrh\Ay<b-Bk,0<y,yGs} 

where  By  >  0  Vi,j  .  Then,  [MCLSIP-1]  can  be  transformed  into  formulation  [MILSIP]. 

Proof:  See  Appendix  B.  ■ 

Remark:     The  restriction   By  >  0    is  acceptable,  because  we  don't  expect  that  an 

interdiction  would  relax  any  of  the  system's  constraints. 

We  would  like  to  solve  [MILSIP]  with  Algorithm  1,  the  Benders  decomposition, 
but  in  order  to  do  so  we  need  to  reformulate  the  problem.  In  Benders  decomposition  the 
feasible  region  of  the  subproblem  is  fixed,  independent  of  the  first  level  variables  (x  in 
our  case,)  while  the  objective  function  changes  at  every  iteration.  To  obtain  this  situation 
in  our  case,  we  force  the  interdiction  through  a  penalty  term  in  the  objective  function, 
which  will  ensure  that  the  use  of  an  interdicted  activity  is  not  cost-effective.  Then,  we 
can  leave  interdicted  activities  free  in  the  subproblem  (their  upper  bounds  are  not  affected 
by  x),  knowing  for  sure  that  these  activities  will  not  be  used  in  an  optimal  solution.  In 
some  problems  like  the  max-flow  network-interdiction  problem,  however,  an  "exact 
penalty"  of  1  allows  an  interdicted  activity  to  be  used  without  compromising  equivalence 
of  the  models,  at  least  in  terms  of  x  (Cormican  et  al.  1997).  The  following  proposition 
gives  us  a  more  general  result: 
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Proposition  3.2:  When  Assumption  3.1  holds,  there  exists  v*  <  oo  such  that,  for  every  v  > 
v* ,  formulation  [MELSIP]  and  the  following  problem,  with  V  =  diag(vl),  have  the  same 
set  of  optimal  solutions  in  x  and  y: 
[MELSIP -2]  z**  =    min    /2(x)  where /2(x)  is  defined  by 

xeX 

[M  -  Sub(x)  -  2]       f2  (x)  =  max     cry  -  xTVy 

yeY 

and        X       ={xe{0A}"  |i«x<r}, 

7       =  {y\Ay<b,  0  <  y  <  U,  y  e  77AT}. 

Proof:   First  we  show  that  for  any  x  e  X  there  exists  v(x)  such  that  for  every  v  >  v(x), 
^(x)  =  ^(x),  and  arg  max^(x)  =  arg  max/2(x) .  To  do  so,  it  suffices  to  show  that 

yey(x)    '  yeY 

(a)  Every  optimal  solution  of  [M-Sub(x)-1]  is  feasible  to  [M-Sub(x)-2]  with  equal 
objective  function  value^ — that  is  trivial — and, 

(b)  Every  optimal  solution  of  [M-Sub(x)-2]  is  feasible  to  [M-Sub(x)-1]  with  equal 
objective  function  value.  To  show  that  we,  need  to  find  v(x)  such  that  for  every  v 

>  v(x)  every  optimal  solution  y  of  [M-Sub(x)-2]  satisfies  xTVy  =  xTy  =  0 . 


To   show   (b),   define    Sx  =  mini  x  y |  y e 7, x  y>0[,    Mx  =  max cry -  f  (x) 

L  J  yeY 

(note  that  ./j(x)  is  clearly  bounded)  and  finally  vx  =  l  +  Mx/Sx  .   Then,  if  the  optimal  y 

is  such  that  x  y>0,  f2(x)<maxcy-Sxvx    which  is  a  contradiction  because,  by 

yeY 

definition,  max  c  y  -  8X vx  <  f  (x)  and  from  (a)  we  know  that  f  (x)  <  f2  (x) . 
yeY 
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The  number  of  feasible  solutions  xeA'is  finite.  So,  let  v*  =  max{v(x)  |x  e  X}.  ■ 

Corollary  3.1:  MILSIP  has  an  optimal  solution  where  the  follower's  part  of  the  solution 
is  a  vertex  of  7=  {  y  |  ^4y  >  b,  0  <  y  <  u,  ye  INTY).  ■ 

Remark:  Proposition  3.2  is  a  variation  on  Morton  and  Wood  (1999).  It  is  shown  there 
that  fl(x)  =  f2(x)  for  all  x  eX,  when  y  is  continuous,  ;r;is  an  upper  bound  on  the 

optimal  dual  multiplier  for  the  constraint  vy-  <  Uj(l-Xj)  in  [M-sub(x)-l]  taken  over  all 

xeX  and  V  =  diag(7t).  (Note  that  computing  the  best  possible  bound  may  require  full 
enumeration  of  the  system  value  for  every  possible  interdiction  plan.)  This  approach 
does  not  work  when  we  allow  discrete  variables  y. 

Let  V  =  diag(v*l).    Based  on  Proposition  3.2  and  Corollary  3.1,  we  can  use 
Algorithm  1,  the  Benders  decomposition,  with  formulation  [MILSIP-2].  Define: 
[Master  (7)]       rnin     z 

xeX,z 

s.t.       z  >  cry  -  xrVy  Vy  <=  Y 

and  apply  Algorithm  1  using  this  master  problem  and  the  subproblem  [M-Sub(x)-2]. 
Furthermore,  it  is  clear  that  the  integrality  cuts  of  Chapter  II  are  valid  here,  too,  and  can 
tighten  the  relaxation  of  [Master(y)]  (see  Proposition  2.1  and  Corollary  2.1). 
(Straightforward  adjustments  are  required  since  MXSP  is  a  max-min  interdiction 
problem,  while  the  development  in  this  chapter  is  for  min-max  system  interdiction.) 
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As  discussed  in  Chapter  II  with  respect  to  MXSP,  the  subproblem  of  Algorithm 

1  finds  an  optimal  reaction  of  the  follower  to  a  specific  interdiction  plan,  which  is 
feasible  to  the  leader.  Hence,  ^(x)  gives  a  lower  bound  on  the  leader's  optimal  solution 
value.  The  master  problem  includes  only  a  subset  of  the  follower's  vertices  and  hence  it 
yields  an  upper  bound  for  the  leader.  Moreover,  the  feasible  region  of  the  subproblems  is 
fixed,  with  a  finite  number  of  vertices,  and  in  every  iteration  of  the  subproblem,  there  is  a 
solution  that  is  a  different  vertex  of  Y.  Thus,  the  algorithm  must  converge. 

We  can  sometimes  refine  the  penalty  term  to  tighten  the  master  problem.  For 
instance,  the  penalty  for  different  activities  may  be  different.  Such  a  modification  is 
essentially  what  we  have  in  MXSP,  where  the  penalty  matrix  V  =  D  represents  the  local 
delays  on  each  arc.  Moreover,  given  an  interdiction  plan  x,  the  penalty  multipliers 
Vj  (y)  for  each  activity  j,  can  be  functions  of  the  optimal  solution  of  the  subproblem 

y  =  y(x) ,  as  long  as  the  cut  we  add  to  the  master  problem,  z  >  ^c  -j)  ■  ~^xjvj(y)yj  ,  is 

j  j 

valid  for  all  xeX.   (But,  V cannot  be  a  function  of  x  since  the  constraints  in  the  master 

problem  would  then  be  nonlinear.) 

Fcould  also  have  non-zero,  off-diagonal  entries  representing  second-order  effects. 

For  instance,  suppose  that  the  two  components  of  the  system  under  study  act  "serially"  so 

that  destroying  either  one  is  as  good  as  destroying  both,  i.e.,  y\=yi.  If  that  Benders  cut 


z<cry  +  [*i*2] 
is  valid,  then  so  is  the  tighter  cut 


v    0 
0    v 
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T  v    -.5v 

z<c  y  +  [xlx2\ 

-  5v         v 


Unfortunately,  Proposition  3.2  and  the  discussion  afterward  do  not  suggest  a 
general  technique  to  determine  a  valid  and  effective  penalty  matrix  V.  Sometimes  the 
structure  of  the  system  suggests  one,  as  in  MXSP  with  finite  delays,  but  that  is  a  special 
case.  Recall  Example  2.1,  where  we  show  the  difficulties  that  an  insufficiently  large 
penalty  might  cause.  On  the  other  hand,  the  running  time  of  Algorithm  1  can  be 
excessive  if  we  use  a  large  penalty  (compare  results  for  d=  5  and  d  =  10  in  Table  3.4). 
Therefore,  we  wish  to  devise  an  algorithm  for  MTLSIP,  similar  to  Algorithm  2E,  that 
does  not  assume  any  bound  on  the  local  effect  of  an  interdiction. 

Following  the  arguments  upon  which  Algorithm  2  is  based,  we  assume  large 

penalty  multipliers  and  wish  to  solve  [Master(y)]  for  the  first  feasible  solution  with 
objective  value  greater  the  current  lower  bound.  This  is  accomplished  by  solving  the 
following  set-covering  problem  (SCP): 

[Master(Y)  - 1]  Find     x  e  X 

s.t.       I(y)rx>l        Vyey 

where  7,  (y)  =  1  if  yy  >  0  and  Ij  (y)  =  0  if  y;  =  0 .     We  can  do  so  because  every  x 

feasible  in  [Master(7)-1]  interdicts  one  of  the  basic  (and  positive)  variables  in  every 
vertex  in  Y,  so  x  must  be  feasible  in  [Master(F)]  and  the  leader's  objective  there 
exceeds  the  lower  bound,  for  v  sufficiently  large.  In  [Master(y)-1],  the  interdictor  tries 
to  interdict  all  the  vertices  thus  far  exposed  by  the  follower,  so  "vertices"  take  the  place 
of  "paths"  in  the  discussion  of  Algorithm  2  in  Chapter  II. 
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Analogs  of  the  various  enhancements  we  have  suggested  for  solving  MXSP  with 
Algorithm  2  are  applicable  to  solving  MILSIP,  too.  To  begin  with,  a  local-search 
procedure  can  be  used  to  generate  more  than  one  vertex  of  the  follower's  feasible  region 
per  iteration.  For  instance: 

(a)  If  a  linear  program  represents  the  follower's  system,  we  can  use  the  last  simplex 
tableau  to  reach  some  or  all  of  the  neighboring  extreme  points  to  the  optimal 
solution.  (Reaching  all  neighboring  extreme  points  could  require  too  much  work, 
but  a  fixed  computational  budget  could  be  allocated  for  finding  some  subset  of 
these  points.) 

(b)  If  MEP  represents  the  follower's  system  and  [M-Sub(x)-1]  is  solved  by  branch  and 
bound,  feasible  solutions  found  during  the  enumeration  could  be  used  in  place  of 
a  local-search  procedure. 

Procedure  Lift  in  Algorithm  2  is  based  on  the  penalties  dk  used  in  Algorithm  1, 

and  it  must  be  modified  to  accompany  the  flexibility  in  the  penalty  matrix  for  the  more 
general  case.  (If  v  is  "very  large,"  it  is  likely  that  Lift  will  have  no  effect.)  Similarly, 
procedure  Compare  should  be  modified  if  the  penalty  matrix  has  non-zero  off-diagonal 
elements.  However,  when  we  use  the  same  diagonal  penalty  matrix  V  for  all  the 
solutions  of  the  subproblem,  procedures  Compare  and  Lift  remain  as  they  were  in 
MXSP. 

Lastly,  we  can  solve  MILSIP  with  a  hybrid  decomposition  algorithm,  just  as  we 
use  Algorithm  3  for  MXSP. 
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B.  INTERDICTION  OF  EVEN  MORE  GENERAL  SYSTEMS 

We  now  generalize  our  results  for  interdiction  of  general  systems,  where  optimal 
solution  of  the  follower's  system  can  be  adequately  modeled  through  an  arbitrary 
optimization  model.  Thus,  the  General  System  Interdiction  Problem  (GSIP)  is  defined  to 
be  the  following  leader's  problem: 

[GSIP]  z  *     =    min    /(x)         where /(x)  is  defined  by 

xeX 

[G-Sub(x)]  /(x)=  max     g(x,y) 

yer(x) 

and  let  y(x)  =  argmax  g(x,y).  (We  assume  that  7(x)  is  non-empty,  g(x,y)  is  bounded 

yeF(x) 

over  Y(x)  for  all  xel  and  the  argmax  is  always  unique.) 

For  constructing  a  Benders-type  decomposition  for  solving  GSIP,  essentially 
Algorithm  1,  we  reformulate  the  problem  as  follows: 

Proposition  3.3:  Assume  that  for  every  x  eX,  we  can  find  a  scalar  c(k)and  vector  of 
penalty  multipliers  v(x)  that  satisfy 

/(£)    =    c(x)-v(x)r£  [3.3.1],      and 

/(x)    >    c(x)-v(x)rx  Vi£l  [3.3.2]. 

Then,  z*  -  z  *  *  where  z*  is  defined  by  [GSIP],  and  z**  is  defined  by 
[GSIP-1]           z**  =  min       z 

z,x 

s.t.    z>c(x)-v(x)rx  VxeX. 

Furthermore,  [GSIP]  and  [GSIP-1]  share  the  same  set  of  optimal  solutions  in  x 
Proof:  From  formulation  [GSIP-1],  z  *  *  =  minz(x)  where  z(x)  =  max  (c(x)  -  v(x)   x} , 

xeX  ieX 

and  conditions  [3.3.1]  and  [3.3.2]  ensure  that  z(x)  =  /(x)  for  all  x  eX.  ■ 
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Corollary  3.2:  For  every  x  gX  such  that  v(x)rx  =  0,  c(£)  =  /(£)  is  necessary  to 
satisfy  condition  [3.3.1]  .  ■ 

A  straightforward  implementation  of  Benders  decomposition  to  formulation 
[GSIP-1]  defines: 

fMaster(X)]       min      z 

s.t.       z>c(x)-v(£)rx  Viel, 

where  X  is  a  subset  of  the  set  of  feasible  interdiction  plans.  (We  usually  associate  each 
constraint  with  a  solution  of  the  subproblem,  but  this  representation  is  equivalent.)  Given 
an  interdiction  plan  x  suggested  by  the  master  problem,  the  subproblem  should  find  a 
scalar  c(x)and  vector  of  penalties  v(x)  such  that  conditions  [3.3.1-2]  hold.  Assume  that 
we  have  such  a  subproblem,  denote  it  by  [G-Sub(x)];  Then,  we  have  established 
Algorithm  1  for  [GSDP].  Note  that  X  is  discrete  and  bounded,  and  therefore  finite,  so 
convergence  is  guaranteed. 

From  Corollary  3.2,  in  order  to  validate  conditions  [3.3.1-2]  we  need  to  solve  [G- 
Sub(x)]  exactly  so  that  we  know  /(x)  exactly.  However,  sometimes  a  sub-optimal 
solution  of  [G-Sub(x)]  is  sufficient: 
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Proposition  3.4:  Assume  that  for  any  x  gX  such  that  f(x)  >  z  *,  the  scalar  c(x)and  the 
vector  of  penalties  v(x)  satisfy 

z*       <    c(x)-v(x)rx  [333],     and 

f{x)    >    c(x)-y(xfx         VxeX  [33.4]. 

(The  multipliers  need  not  satisfy  conditions  [3.3. 1  -2] .)  And,  for  any  x  eX  such  that 

/(x)  =  z*,  c(x)and  v(x) satisfy  conditions  [33.1-2].  Then,  z*  =  z**  (where  z  is 
defined  by  [GSIPJ  andz**  is  defined  by  [GSIP- 1  ]. )  ■ 

Proof:  Condition  [3.3.3]  ensures  that  z(x)  >  z  *  for  any  xeX  such  that  /(x)  >  z  *,  and 
for  any  x  eX  such  that  f(x)  =  z  *,  conditions  [3.3.1]  and  [3.3.2]  ensure  that  z(x)  =  z  *  . 
Thus,  z  *  *  =  minz(x)  =  z*. 

xeX 

We  now  describe  a  possible  use  for  the  last  proposition.  Assume  that  during  the 
solution  process  of  [G-Sub(x)]  we  know  that  x  cannot  be  optimal,  i.e.,  we  find  y  such 
that  g(x,y)  >  z  .  Then,  by  Proposition  3.4,  verifying  that  conditions  [3.3.3-4]  hold  with 
respect  to  x  is  sufficient  to  guarantee  convergence.  See  an  implementation  of  this  idea 
in  Chapter  IV,  in  Procedure  Cutoff. 

Now  that  we  have  established  the  basics  of  Algorithm  1  for  [GSIP],  we  can 
modify,  extend  and  improve  the  techniques  as  we  did  for  MXSP  and  MELSIP: 

(a)  Add  all  the  enhancements  discussed  with  regard  to  Algorithm  1,  including  the 
integrality  cuts, 

(b)  Derive  Algorithm  2  and  2E  (when  the  different  enhancements  are  practical),  and, 

(c)  Finally,  derive  Algorithm  3  for  [GSIP]. 
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We  would  like  to  point  out  that  the  existence  of  scalars  and  penalty  multipliers 
that  satisfy  conditions  [3.3.1-2]  does  not  require  that  the  function  /(x)  be  convex,  or 
anything  else,  when  the  set  X  includes  only  binary  variables.  This  is  so  because  we  are 
interested  in  the  value  of  f(x)  only  at  certain  of  the  corner  points  of  the  ^-dimensional 
hypercube,  and  over  these  points  it  is  possible  to  support  any  kind  of  function  with  a 
linear  cut.  (For  instance,  if  we  know  that  z*  >  0  we  can  always  set  c(x)  =  /(x)  and  for 
every  k,  let   vk(x)  =  f(x).    The  corresponding  cut  we  add  to  the  master  problem, 

z  ^  c(x)  -  ^XjVj(x)yj  ,  would  be  valid,  but  useless.)   However,  it  is  usually  easier  to 

3 

find  relatively  good  penalty  multipliers  when  the  function  /(x)  is  convex  for  continuous 
x,  using  gradient  or  sub-gradient  information. 

In  general,  Proposition  3.3  and  Proposition  3.4  do  not  provide  a  method  to 
derive  the  necessary  penalty  multipliers  for  Benders  cuts  (although  the  constant  c(x)  can 
always  be  found  by  solving  [G-Sub  (x)  ]).  However,,  we  exploit  those  propositions  in  the 
next  two  chapters  to  validate  penalty  multipliers  that  we  can  create  based  on  the  special 
structure  of  certain  system-defense  problems. 

C.         CONCLUSIONS 

In  this  chapter  we  have  shown  that  the  techniques  used  to  solve  the  shortest-path 
network-interdiction  problem  can  be  used  for  solving  interdiction  problems  concerned 
with  more  complicated  systems.  Sufficient  conditions  are  given  to  establish  a  Benders- 
type  decomposition  algorithm  for  solving  a  general  system-interdiction  problem,  too. 


56 


The  construction  of  a  useful  decomposition  algorithm  for  solving  a  system- 
interdiction  problem  depends  on  the  specific  structure  of  the  interdicted  system.  As 
shown  in  this  chapter,  the  helpful  enhancements  for  solving  MXSP  we  saw  in  Chapter  II 
may  be  applicable  to  other  interdiction  problems,  as  well. 

In  the  next  two  chapters  we  use  this  chapter's  results  to  construct  algorithms  for  a 
system-defense  problem  and  a  stochastic  system-interdiction  problem.  Both  cases  are 
based  on  MXSP,  but  just  as  we  have  shown  in  this  chapter,  the  results  there  can  be 
applied  to  more  general  system-defense  and  stochastic  system-interdiction  problems. 
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IV.  SYSTEM  DEFENSE  -  THE  SHORTEST-PATH  NETWORK 

DEFENSE  PROBLEM 

When  a  system  user  expects  his  system  to  be  interdicted,  he  may  be  able  to 
expend  resources  to  protect  that  system  to  mitigate  against  the  effects  of  interdiction.  In 
this  section  we  are  interested  in  the  following  question:  How  should  a  system  user 
employ  limited  resources  to  "harden"  the  components  of  his  system  to  best  protect 
against  interdiction,  given  that  the  interdictor  will  optimize  his  interdiction  with 
knowledge  of  those  improvements?  To  answer  to  this  question,  we  formulate  and  discuss 
the  general  system-defense  problem  (SD)  and  suggest  extensions  of  Algorithm  1-3  as 
solution  procedures. 

In  the  United  States,  the  importance  of  system  defense  has  been  underscored  by 
establishment   of  the  President's   Commission   on   Critical   Infrastructure  Protection 
(PCCIP).  The  executive  order  that  creates  the  PCCIP  (The  White  House  1996)  states: 
"Certain  national  infrastructures  are  so  vital  that  their  incapacity 
or  destruction  would   have  a  debilitating   impact   on  the   defense  or 
economic  security  of  the  United  States.     These  critical  infrastructures 
include  telecommunications,  electrical  power  systems,  gas  and  oil  storage 
and  transportation,  banking  and  finance,  transportation,   water  supply 
systems,  ...." 
The  goal  of  PCCIP  is  to  develop  a  strategy  for  protecting  those  systems  against  both 
physical  and  electronic  attacks.    The  models  we  propose  are  most  suitable  for  studying 
survivability  of  systems  subject  to  physical  attack. 
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Throughout  the  development  of  SD,  we  use  the  problem  of  Defending  the 
Shortest  Path  (DSP)  as  an  illustrative  example.  However,  the  results  can  be  easily 
generalized  to  other  and  more  general  system  defense  problems. 

A.         DEFENDING  THE  SHORTEST  PATH  -  THE  MODEL 

DSP  is  an  extension  to  MXSP  (see  Chapter  H),  where  before  the  leader  attempts 
any  interdictions,  the  network  user  may  harden  (protect)  some  of  his  arcs  against  a 
possible  interdiction.  The  network  user  has  a  fixed  budget  for  hardening  arcs  and  any 
hardened  arc  is  considered  invulnerable  to  subsequent  interdiction.  So,  in  DSP,  the 
network  user  first  hardens  certain  arcs,  the  leader  then  interdicts  some  subset  of 
"unhardened"  arcs,  and  finally  the  network  user  traverses  a  post-interdiction  shortest 
path. 

We  assume  that  the  network  user  has  limited  resources  and  that  he  cannot  make 
his  system  completely  invulnerable.  Thus,  the  network  user  cannot  completely  protect 
any  shortest  s-t  path.   Let  the  set  of  feasible  defense  plans  for  the  network  user  be  given 

by  G  =  {g  €  {0,1}        Hg  <  h}.  We  assume  absolute  protection  so  that  gk  =  1  implies  that 

arc  k  cannot  be  interdicted.  DSP  finds  the  optimal  defense  strategy  for  the  network  user, 
g*,  and  the  value  of  the  system,  i.e.,  the  length  of  the  shortest  path  the  network  user  is 
assured  to  have  available  for  use. 

Notice  that  for  every  feasible  defense  plan  g,  the  associated  value  of  the  system  is 
given  by  a  solution  to  an  MXSP  where  the  protected  activities  are  invulnerable.  And, 
recall  that  MXSP  is  NP-hard.  Thus,  we  need  to  solve  an  NP-hard  problem  just  to 
evaluate  the  objective  function  of  a  feasible  solution  to  DSP.  This  fact  leads  to  the 
following  complexity  result: 
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Proposition  4.1:  DSP  is  NP-hard  and  not  known  to  be  in  NP.  ■ 

Formally,  given  a  graph  Q={N,A),  DSP  is  defined  as  the  following  problem  for 

the  system  user: 

[DSP]     zD  =  min     max      min    cry 

geG    xeX(g)    yeY(x) 

where  G       =  {g  e  {OJL}  ^'  I  #g  <  h}, 

X(g)   =  [xe{Oa}^'|i?x<r,0<x<l-g},   and 

y  is  an  incidence  vector  for  an  s  - 1 
Y(x)   =    y 

path  that  is  feasible  with  respect  to  xj 

Note  that  DSP  is  a  min-max-min  instance  of  the  Linear  System-Defense  Problem 
(LSDP),  which  we  defined  in  Chapter  I  (since  7(x)  can  be  represented  by  a  set  of  linear 
flow-balance  constraints  and  non-negativity  restrictions).  For  modeling  purposes  we  have 
the  following  assumption: 

Assumption     4.1:     The     sets     G,    X(g)    for     all     geGand     7(x)     for    all     x 
[x  g  {0,1}  ^ '    Rx  <  r,  0  <  x  <  1  j  are  not  empty.  ■ 

DSP  can  be  viewed  as  a  min-max  system-interdiction  problem  where  the  network 
user  is  the  leader  and  the  interdictor  is  the  follower.  In  DSP,  the  network  user,  now 
called  the  "defender,"  minimizes  the  effectiveness  of  the  interdictor's  best  possible 
interdiction  plan  by  choosing  a  defense  plan  that  prevents,  or  "interdicts,"  some  of  the 
interdictor's  possible  activities.  This  observation  suggests  solving  DSP  through  a  nested 
decomposition  algorithm.   In  particular,   the  master  problem  for  DSP  uses  one  of 
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Algorithms  1,  2  or  3,  except  that  the  variables  correspond  to  defense  plans,  rather  than 
interdiction  plans,  and  each  subproblem  solves  an  instance  of  MXSP  by  applying  one  of 
those  algorithms. 
B.         NESTED  DECOMPOSITION  FOR  SOLVING  DSP 

Let  z(g)  be  the  length  of  the  shortest-path  the  network  user  guarantees  by 
defending  with  plan  g.  Then,  the  network  user's  problem  is  equivalent  to  min  z(g) . 

geG 

By  Proposition  3.3,  to  apply  Algorithm  1  to  DSP,  it  suffices  to  have  for  any 
given  defense  plan  g  a  constant  c(g)  and  a  vector  of  penalties  vD  such  that: 

(a)  z(.g)>c(g)-gTVDx(g)    V  geG,  and 

(b)  z(g)  =  c(g)-grVbx(g), 

where  VD  =  diag(v£>),  and  x(g)  is  the  optimal  response  of  the  interdictor  to  g . 

Since  g  VDx(g)  =  0  for  all  geG  (the  interdictor  cannot  interdict  a  protected 
arc),  based  on  Corollary  3.2  we  must  set  c(g)  =  z(g)  =  cry(x(g)) ,  where  y(x(g)) 
denotes  the  shortest-path  response  of  the  network  user  given  x(g) .  Thus,  we  can 
calculate  c(g)  by  solving  the  MXSP  associated  with  defense  plan  g .  (For  simplicity,  we 
assume  that  y(x(g))  and  x(g)  are  unique,  but  all  results  in  this  chapter  can  easily  be 
generalized  to  allow  multiple  optimal  responses.) 

Assuming  the  existence  of  a  valid  penalty  vector  v^,  we  can  solve  DSP  through 
Nested  Algorithm  J  (denoted  by  NA-1)  where  the  master  problem  and  subproblem  are: 

[D  -  Master(G)]  Zx  -     min      z 

G        geG 

s.t.       z>cTy(x(g))-gTVDx(g)       VgeG 
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[D  -  Sub(g)]    zx  =    max        min       cry 

s        xeX(g)      yer(x) 


where  X(g)     =[xe{04}^'    R*  <  r,0<  x  <  1  -gl,   and 

F(x)     =< 


y  is  an  incidence  vector  for  an  s  - 1 
path  that  is  feasible  with  respect  to  x 


where  G  is  a  subset  of  all  the  possible  defense  plans. 

At  every  iteration  of  the  decomposition  algorithm,  the  master  problem  suggests  a 
new  defense  plan  g  and  update  zD ,  and  the  subproblem  solves  the  system-interdiction 

problem  associated  with  g ,  adds  the  solution  to  G ,  and  updates  zd  ,  if  appropriate.  (The 
subproblem  is  simply  an  MXSP  which  is  solved  with  Algorithm  1,  or  2  or  3.)  If  the 
solution  of  the  master  problem  or  the  subproblem  is  ever  repeated,  we  must  have 
zd  -  ZD   and  the  algorithm  has  converged.     Therefore,  the  algorithm  is  theoretically 

guaranteed  to  converge,  if  the  number  of  possible  interdiction  plans  or  defense  plans  is 
finite. 

The  remaining  question  is,  of  course,  how  to  determine  a  valid  penalty  vector  v^ . 
We  will  answer  this  question  for  DSP,  as  well  for  the  more  general  LSDP,  under  the 
following  assumption. 

Assumption  4.2:  The  feasible  set  of  interdiction  plans,  X,  is  "closed"  in  the  sense  that 
any  interdiction  plan  that  is  apart  of  a  feasible  interdiction  plan  is  feasible  too. 

This  assumption  is  reasonable  if  interdictions  consume  non-negative  quantities  of 
resource  and  do  not  generate  additional  resource. 
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Proposition  4.2:  Let    V[  =  diag(v)    be  a  valid  penalty  matrix  for  a  linear  system 
interdiction  problem  LSIP: 

[LSIP]  Zj  =   min         max      cry 

xeX  yer(x) 

where  X      ={xe {0,1}"  | Rx < r\  and 

Y(x)  ={y\Ay<b,  0<y<U(l-x)}. 

i.e.,  (by  Proposition  3.2)  [LSIP]  araf  [LSIP-1]  /zaw  the  same  set  of  optimal  solutions 
and  the  same  objective  function  value,  where: 

[LSIP-1]       Zt  =   min        max    cry-xry7y 

xeX  yeY 

where  X  =  {xg  {0,1}"  |  Rx  <  r},   and 

7  =  {y|^y<b,  0<y<U)}. 
Also,  let  [LSDP]  be  the  system-defense  problem  associated  with  [LSIP]: 
[LSDP]  Zn  =  max    min       max      cry 

geG    x€X(g)     yey(x) 

where  5         =  {g  e{0$n  |  #g<h}, 

X(g)     =[xg{04}"  |/&<r,0<x<l-g],   and 
y(x)     ={y|^y<b,  0<y<C/(l-x)}. 

Then,  when  Assumption  4.2  /*oA&,  VD  =  Vj  is  a  valid  penalty  matrix  for  solving  SD  with 

algorithm  NA-1. 

Proof:  By  Proposition  3.3  and  Corollary  3.2,  it  is  sufficient  to  show  that  for  all  x  e  X 

and    gsG,     zD(g)  =  cTy  <cTy(x)  +  gTVjX    where    y  =  y(x(g)).    Let    Xg     be    the 
interdiction  plan  that  interdicts  an  activity  only  if  it  is  interdicted  by  interdiction  plan  x 
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and  not  protected  by  g.    Assumption  4.1  and  the  construction  ensure  that  Xg  eX(g) . 

Clearly,  c  y(Xg)  >  zD(g).  Now,  y(Xg)  e  Y(x)  and  due  the  optimality  of  y(x)  in  the  inner 
maximization  in  [LSIP-1]  that  is  associated  with  x,  we  must  have 
c  y(x)  >  cry(Xg)  -  xry7y(Xg) .    Notice  that  (xTVIy(xg))k  >  0  can  happen  only  when 

y(xg)*  >  Oand  xk  =  1,  but  that  implies  gk  =  xk  =1.    So,  xrV7y(Xg)  =  grV7y(Xg),  and 

c  y(x)  +  g   V^y(Xg)  >  c  y(Xg) .  This  finishes  the  proof  because  cry(Xg)  >  Zpig),  and 

so  cry(x)  +  grV7y(Xg)  >  zD(g) ,  too.  ■ 

Corollary  4.1:  Proposition  4.2  holds  even  when  some  or  all  of  the  variables  y 
(the  system's  fundamental  variables)  are  restricted  to  integer  values,  since  nowhere  in  the 
proof  of  that  proposition  is  y  is  required  to  be  continuous. 

To  better  understand  Proposition  4.2,  consider  its  meaning  in  DSP.  In  this  case, 
interdicting  an  arc  k  increases  the  length  of  the  arc  by  dk,  and  hence  cannot  increase  the 
length  of  the  shortest  path  by  more  than  dk.  In  the  same  sense,  protecting  this  arc  cannot 
decrease  the  shortest  path  by  more  than  the  difference  between  the  original  length  of  the 
arc  and  its  length  after  interdiction,  namely  dk.  Indeed,  Proposition  4.2  proves  that 
VD  =  D ,  where  Z)=diag(d),  will  work. 

We  now  focus  on  [D-Sub(g)]  in  NA-1  for  DSP.  We  might  need  to  solve  this 
problem  many  times  and  so  it  may  be  useful  to  have  some  kind  of  a  "warm  start,"  that 
uses  information  from  previous  iterations.  When  solving  [D-Sub(g)],  the  master 
problem  is: 


-65 


[Sub(g)-Master(Y)]  z$  =      max        z 

Y  xeX(g) 


s.t.        z<cry  +  xrDy       Vye7 


Notice  that  all  the  cuts  of  the  form  z  <  c  y  +  \TDy  are  valid  independent  of  the  defense 

plan.  Thus,  as  a  warm  start,  we  can  begin  a  new  iteration  of  the  algorithm  with  the  set  Y 
from  the  end  of  the  previous  iteration. 

In  NA-1  we  also  incorporate  Procedure  Cutoff.  Recall  that  the  smallest  objective 
values  from  the  subproblems  (the  interdictor's  problem)  solved  so  far  is  an  upper  bound 
on  zD ,  denoted  by  zd  ■  In  consecutive  iterations,  we  can  terminate  solving  a  subproblem 
when,  given  g ,  the  subproblem  finds  a  sub-optimal  solution  x(g)  e  X(g)  with  optimal 
response  y(x(g))  such  that  cry(x(g))  >  zd  ■  This  technique  uses  Proposition  3.4:  Once 
we  recognize  that  the  current  defense  plan  g  is  not  optimal,  the  new  cut  generated  from 
the  subproblem  need  not  be  tight  at  g .  Thus  we  stop  solving  the  subproblem  with  a  sub- 
optimal  solution  x(g) ,  add  x(g)  to  X  and  solve  again  the  master  defense  problem. 
Convergence  is  guaranteed  because  the  new  Benders  cut,  z  >  cry(x(g))-grWx(g) 
ensures  that  g  can  no  longer  be  the  optimal  solution  of  the  master  defense  problem. 
(Recall  that  the  solution  of  the  master  defense  problem  z-  is  a  lower  bound.  If  g  were 
still  optimal,  we  would  have  a  contradiction  since  we  cannot  have 
zk  >  cry(x(g))  -  grHx(g)  >  zd  .) 

Nested  Algorithm  2E,  denoted  by  NA-2  and  derived  from  Algorithm  2E,  can  be 
used  to  solve  DSP  (and  other  LSDPs)  as  well.   In  the  highest  level,  the  system  user  tries 
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to  prevent  interdiction  plans  suggested  by  the  interdictor.  For  each  new  defense  plan  the 
interdictor  solves  the  interdiction  problem  with  Algorithm  2E.  When  the  system  user 
fails  to  prevent  all  the  interdiction  plans  suggested  so  far  by  the  interdictor,  the  algorithm 
terminates.  The  best  defense  plan  the  system  user  has  tried  until  now  is  an  optimal 
defense  plan.  The  algorithm  must  converge  if  the  number  of  possible  interdiction  plans 
or  defense  plans  is  finite. 

Recall  that  Algorithm  2E  includes  several  special  procedures,  namely 
Local_Search,  Compare  and  Lift.  The  concept  of  local  search  in  DSP  translates  into 
the  generation  of  more  than  one  interdiction  plan  (to  be  covered  by  a  defense  plan)  per 
iteration.  Fortunately,  when  we  solve  each  subproblem  we  are  actually  suggesting 
interdiction  plans  and  evaluating  their  objective  function  values  (shortest-path  lengths 
given  the  interdiction).  We  can  keep  this  information  and  every  interdiction  plan  with 
objective  value  higher  than  zD   (when  the  interdiction  plan  was  exposed  or  after  the 

lower  bound  was  updated),  can  be  introduced  into  the  set  of  interdiction  plans  to  be 
covered  by  any  new  defense  plan. 

Procedures  Compare  and  Lift,  as  described  in  Chapter  II  with  respect  to  MXSP, 
apply  to  DSP  with  essentially  no  change. 

In  NA-2  we  incorporate  Procedure  Cutoff  just  as  we  do  in  NA-1.  This  procedure 
is  helpful  when  we  have  a  good  heuristic  for  the  interdictor' s  problem,  and  we  do  have 
such  a  heuristic  when  the  interdictor  has  a  single  resource  constraint.  In  this  case,  we  can 

solve  the  interdictor' s  master  problem  as  an  SCP  ([Master(7)-2c]  in  Chapter  II),  and  we 
can  run  Algorithm  2E  as  a  heuristic  by  solving  that  master  problem  using  only  the 
greedy  SCP  heuristic. 
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Last,  as  we  suggested  for  NA-1,  we  can  employ  a  warm  start  in  NA-2  using 
information  from  previous  iterations.  This  may  speed  the  convergence  of  the  inner 
Algorithm  2  used  to  solve  the  subproblem.  Recall  that  at  the  end  of  Algorithm  2E  we 

have  two  sets  of  s-t  paths.  Those  sets  are  Y  and  Y*  where  Y*  is  a  set  of  "reserve 
paths."  We  can  merge  these  two  sets  and  use  them  as  a  starting  reserve  set  for  the  next 
iteration  of  the  inner  covering  algorithm  used  to  solve  the  subproblem.  By  doing  this,  we 

may  require  fewer  iterations  to  generate  a  list  of  extreme  points  in  Y  that  the  interdictor 
cannot  cover,  and  thus  solve  the  subproblem  using  fewer  iterations. 

Unfortunately,  computational  experience  indicates  that  the  effort  involved  with 
the  warm  start  is  not  always  worthwhile.    In  MXSP  we  are  able  to  generate  paths  very 

quickly,  but  we  drop  dominated  paths  and  lift  others,  so  the  actual  set  Y  at  the  end  of  the 
algorithm  is  only  a  small  subset  of  the  paths  that  were  generated  during  the  course  of  the 
algorithm.  Therefore,  if  we  want  to  save  all  the  original  paths,  extra  work  is  needed;  it 
may  be  simpler  and  faster  to  regenerate  those  paths  in  subsequent  iterations. 

So  far,  we  have  discussed  two  nested  decomposition  algorithms  for  solving  DSP, 
NA-1  and  NA-2.  In  should  be  clear  that  we  can  also  establish  an  analogous  version  of 
Algorithm  3,  Nested  Algorithm  3  (NA-3).  Given  the  above  discussion  creating  this 
algorithm  is  straightforward  and  we  omit  any  further  description. 


68 


C.         COMPUTATIONAL  EXPERIENCE 

To  test  the  algorithms  we  have  constructed,  we  use  the  same  structure  of  the  test 
problems  of  Chapter  II.  The  only  additional  parameters  are  the  total  defense  resource 
available  /*o(we  assume  a  single  defense  resource)  and  the  defense  resource  needed  to 

defend  each  arc  k,  namely  hk,  which  is  integer  and  uniformly  distributed  on  [l,h]. 

Algorithm  NA-1  is  tested  with  procedures  Warm_Start  and  Cutoff.  Algorithm  NA-2  is 
tested  only  with  procedure  Cutoff.  We  do  not  test  NA-3  here  because  for  the  amount  of 
interdiction  resources  examined,  Algorithm  2E  and  Algorithm  3  give  similar  results  (see 
Table  2.1) 

Table  4.1  shows  the  average  results  across  10  problems  for  3  different 
combinations  of  defense  and  interdiction  resources.  For  instance,  in  NA-2  problem  set 
3D,  the  master  defense  problem  includes  535  cuts  on  average,  each  one  representing  an 
interdiction  plan.  The  algorithm  generates  those  535  interdiction  plans  while  solving 
only  265  interdiction  problems,  because  of  the  Local_Search  procedure.  Moreover, 
those  155  interdiction  problems  are  solved  in  440  CPU  seconds,  even  though  a  single 
interdiction  problem  with  30  units  of  interdiction  resources  requires  25  seconds  CPU  on 
average  (see  Table  2.1  problem  set  2.)  The  time  improvement  factor  is  almost  10,  and  is 
a  result  of  procedure  Cutoff. 
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Algorithm  NA-1 

Algorithm  NA-2 

Prob 

ho 

n> 

Tx 

Sj            Nf 

Nl 

T 

s2         Nj         nJ 

PD 

ID 

10 

20 

325 

60             40 

140 

33 

17            65          1210 

155 

2D 

15 

20 

475 

175            72 

180 

75 

70           135          1670 

305 

3D 

10 

30 

- 

- 

- 

440 

265           155          3375 

535 

Table  4.1:    Computational  results  for  the  shortest-path  network  defense  problem,  with  10x10  inner  nodes 
(a=396),  c=10,  d=l0,  r=5  and  h=5. 


Legend:    . 

s,- 

n! 


Running  time  in  CPU  seconds  for  Algorithm  NA-/. 
Standard  deviation  in  CPU  seconds  of  Tz . 

Number  of  iterations  in  the  master  defense  problem  in  NA-;. 

Total  number  of  iterations  in  the  master  problem  of  the  sub- 
problem  (the  interdiction  problem)  in  NA-/'. 

Number  of  interdiction  plans  (i.e.,  cuts)  in  the  master  defense 
problem  in  NA-2. 


In  NA-1  we  can  see  the  advantage  of  procedure  Warm_Start,  too.  In  NA-1 
problem  set  2D,  we  solve  72  interdiction  problems  on  average,  with  total  of  180  master 
iterations  in  the  interdiction  problems.  On  the  other  hand,  when  we  solve  only  one 
interdiction  problem,  we  need  51  iterations  on  average  (see  Table  3.1).  Thus,  every  new 
defense  plan  requires,  on  average,  only  2  iterations  in  the  interdiction  problem,  due  to  the 
Warm_Start  and  Cutoff  procedures.  Those  72  interdiction  problems  are  solved  in  475 
CPU  seconds  while  a  single  interdiction  problem  requires  110  CPU  seconds  (see  Table 
3.1).  Therefore,  the  overall  time  improvement  factor  is  more  than  15. 
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D.         CONCLUSIONS 

The  system-defense  problem  that  we  first  defined  as  a  natural  extension  for  the 
system-interdiction  problem,  turns  out  to  be  a  system-interdiction  problem  in  itself, 
where  the  defender  interdicts  the  interdictor's  system.  This  observation  let  us  solve  the 
problem  of  defending  the  shortest  path  with  nested  decomposition  algorithms. 
Fortunately: 

(a)  We  can  use  the  fact  that  the  defender  interdicts  a  system-interdiction  problem,  to 
find  valid  penalty  multipliers  that  are  needed  in  Algorithm  1, 

(b)  The  enhancements  included  in  Algorithm  2E  are  applicable  here,  too,  and 

(c)  Every  subproblem  solves  a  system-interdiction  problem  with  a  decomposition 
algorithm,  but  solving  k  subproblems  doesn't  require  k  times  the  time  that  one 
problem  requires,  due  to  Warm_Start  and  Cutoff  procedures  we  include  in  the 
nested  decomposition. 
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V.  STOCHASTIC  SHORTEST-PATH  NETWORK  INTERDICTION 

Uncertainty  may  play  a  key  role  in  some  interdiction  scenarios.  For  instance,  the 
interdictor  may  have  only  limited  intelligence  on  the  system  he  attacks,  and  the  success 
of  interdiction  attempts  may  be  uncertain.  Thus,  the  interdictor  must  determine  his 
actions  with  incomplete  information  about  the  current  state  of  the  system  and/or  how  the 
system  will  "react"  after  interdiction.  We  take  an  obvious  approach  to  modeling 
stochastic  situations:  We  assume  that  the  interdictor  has  a  measure  for  the  expected  value 
of  the  system  after  interdiction,  and  that  he  wishes  to  degrade  this  measure  as  much  as 
possible. 

Throughout  the  chapter  we  focus  on  the  max-min  stochastic  shortest-path 
network-interdiction  problem,  S-MXSP,  where  interdiction  success  is  uncertain.  We  note 
that  Cormican  et  al.  (1998)  have  studied  one  stochastic  network-interdiction  problem, 
with  a  different  objective  than  MXSP,  where  other  network  data  may  be  uncertain,  too. 
However,  we  assume  that  all  network  data  are  known  exactly.  We  show  how  the  results 
of  Chapter  HI  can  be  used  to  establish  decomposition  algorithms  for  solving  such 
stochastic  network-interdiction  problems,  exactly  or  approximately.  The  approach  can  be 
used  for  solving  other  stochastic  system-interdiction  problems,  too. 

A.         THE  MODEL 

The  mathematical  programming  formulation  of  S-MXSP  on  a  directed  graph 
£=CAM>  is: 
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[S-MXSP]  max£ 

xeX 


where: 

(a)  s  €{04}       is  a  random  vector:  The  outcome  of  the  random  variable   sk  is 

denoted  by  sk.  sk  =  l  with  probability/?^  and  sk=0  with  probability  \-pk.   Thus, 

0  <  pk  <  1  is  the  probability  an  interdiction  attempt  on  arc  k  is  successful.  We 
assume  that  the  successes  of  separate  interdiction  attempts  are  independent 
events. 

(b)  The     rest     of    the     formulation     is     the     same     as     in     MXSP.         Thus, 

X  =  {x  6{0,lr  '  |^x  <  r}  represents  the  set  of  feasible  interdiction  plans  and  Y  is 
the  set  of  all  s-t  paths,  represented  in  MXSP  through  flow  balance  constraints. 
For  simplicity  and  without  lost  of  generality  we  assume  that  for  every  k,  dk  <  00 

(an  infinite  delay  can  be  replaced  by  a  very  large,  but  finite,  delay,  which  would 
ensure  that  no  shortest  path  would  use  arc  k  when  it  is  interdicted),  and  we  assume 
that  all  arcs  are  interdictable  (a  non-interdictable  arc  k  can  be  modeled  by  setting 
4=0). 

In  S-MXSP,  the  inner  minimization  problem  is  a  standard  shortest-path  problem 
with  arc  lengths  c*  +  Xk  sk  dk.  That  is,  the  network  user  finds  a  shortest  s-t  path  given  the 

interdiction  plan  x  and  its  random  outcome  xksk  for  every  k.    We  denote  this  shortest 

path  by  y(x,s)  where  ^(x,s)  =  1  if  the  path  y(x,s)  uses  arc  k,  else  yk(x,s)  =  0.    For 
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simplicity,  we  assume  y(x,s)   is  unique,  but  all  results  in  this  chapter  can  easily  be 
generalized  to  allow  multiple  shortest  paths. 


Let    E 


^Hick+xkskdk)yk 


Ykik 


=  E 


^(ck+xkskdk)yk(x,s) 

k<=A 


=  z(x)    be  the 


expected  length  of  the  shortest  s-t  path  given  interdiction  plan  x,  so  that  S-MXSP  is 
equivalent  to  maxz(x).     z(x)  can  be  calculated  exactly  by  solving  the  shortest-path 

xeX 

problem  associated  with  each  outcome  of  the  random  vector  s.   The  literature  also  offers 
several  algorithms  for  estimating  z(x)  (e.g.,  Alexopoulos  1997,  Fishman  1985). 

The  basic  model  assumes  that  only  a  single  interdiction  may  be  attempted  on  any 
arc.  The  following  discussion  shows  that  this  is  not  actually  a  restriction.  Assume  that 
we  have  an  arc  k,  which  can  be  attacked  by  n  different  methods.  Each  method  includes 
one  or  more  independent  and/or  dependent  interdiction  attempts.  For  instance,  arc  k  can 
be  attacked  by  an  airplane  formation,  2  cruise  missiles,  or  both,  so  we  have  three  possible 

methods.  Denote  by  pJk  the  probability  of  successful  interdiction  when  method  of  attack 

j  is  chosen,  and  by  d{  the  delay  expected  on  arc  k  when  attack  by  method  j  is  successful. 
To  handle  this  situation  we  introduce  the  following  construction: 

(a)  We  "break"  the  arc  k  into  n  serial  arcs,  k1 ,. . . ,kn  ,  each  with  length  ck/n . 

(b)  We  set  the  probability  of  successful  interdiction  on  arc  kJ  to  be  pJk  and  the  delay 

when  the  arc  is  interdicted  successfully  to  d{  . 

(c)  Last,  we  add  the  constraint  x  x  +jc  2 +•••+*  „  <  1  to  make  sure  that  only  one 

method  of  attack  is  chosen  (recall  that  a  method  of  attack  may  include  several 
interdiction  attempts). 

-75- 


The  construction  ensures  that  if  none  of  the  arcs  kl,...,kn  is  interdicted,  or  one  of 
the  arcs  is  interdicted  but  not  successfully,  the  effective  length  of  the  composite  arc  k\  is 
nx(ck/ri)  =  ck.     But  if  method  of  attack  j  is  chosen,  and  arc   kJ    is  interdicted 

successfully,  the  effective  length  of  the  composite  arc  k\  is  n  x  (ck/n)  +  d{  ,  as  required 

B.         DECOMPOSITION  APPROACH 

By  Corollary  3.2,  we  can  construct  Algorithm  1  for  solving  S-MXSP  if  we  have 
constants  c(x)  and  penalty  multipliers  v^^)  such  that: 

[5.1]  z(x)     =  c(x) +  ^Tvk(x)xk      VxgI,      and 

keA 

[5.2]  z(x)    <  c(x)  +  X  vk(%)xk      V  x,  x  e  X 

Given  the  coefficients  c(x)  and  v(x) ,  the  master  problem  of  Algorithm  1  is 
|Master(X)l  max    z 

s.t.      z  <  c(x)  +  2 vk(*)xic  f°r  every  x  e  X 

keA 

where  X  is  a  subset  of  the  set  of  feasible  interdiction  plans,  and  the  subproblem,  Sub(x), 
provides  c(x)and  v(x)such  that  [5.1]  and  [5.2]  hold.  The  following  proposition  shows 
how  valid  c(x)  and  v(x)  can  be  calculated. 

Proposition  5.1:  For  every  x  gX, define. 

[5.3]  c(x)     =  2^£fc(x^)],  and 

keA 

[5.4]  vk(x)   =  dkE[skyk(x,~s)]      WeA 

Then,  conditions  [5-1]  and  [5-2]  hold. 
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Proof: 
z(x)    =E 

=  E 
<E 


min  ^(ck +xkskdk)yk 

y*YkeA 


^(ck+xkskdk)yk(x,s) 

keA 

Y,(ck+xkskdk)yk(k,s) 

keA 


for  all  x  g  X 


and  equality  must  hold  when  x  =  x,  because  given  x  and  s,  yk{x,s)  is,  by  definition, 
the  shortest  path.  Now, 


Y,(ck+xkskdk)yk(x,s) 

keA 


=  Z£M*(x,s)]+  ^xkdkE[skyk(x,s)] 

keA  keA 

=  c(x)+^vk(x)xk,      m 

keA 


Remarks: 

(a)  c(  x  )  is  the  average  length  of  the  shortest  path  that  the  network  user  traverses, 

excluding  delays,  given  interdiction  plan  x .  £"[^(x,  s)]  is  the  probability  that  the 

network  user  traverses  arc  k,  given  interdiction  plan  x . 

(b)  If  xk  =  1 ,  Vjt(x  )  is  the  average  delay  the  network  user  experiences  on  arc  k,  given 

interdiction  plan    x.    E[skyk(x,s)]   is  the  probability  that  the  network  user 

traverses  arc  k  given  that  the  arc  is  successfully  interdicted. 

(c)  The  proposition  actually  establishes  that  if  x  does  not  interdict  arc  k,  v*(x) 
bounds  the  (average)  gain  the  interdictor  can  achieve  over  z(x)  by  interdicting 
this     arc.     Notice     that     when      xk=0,      E[skyk(x,s)]  =  E[sk]E[yk(x,s)] 
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=  pkE[yk(x,  s)]   where   E[^(x,s)]   is  the  probability  that  the  network  user 

traverses  arc  k  given  interdiction  plan  x. 

Proposition  5.1  enables  solution  of  S-MXSP  through  Benders  decomposition, 
i.e.,  through  Algorithm  1,  at  least  in  theory.  The  master  problem  suggests  an  interdiction 
plan  x ,  and  the  subproblem  (/')  evaluates  z{  x  ),  which  may  update  the  lower  bound,  and 
(if)  generates  a  new  cut  for  the  master  problem  through  calculation  of  £[^(x,s)]  and 

E[skyk(x,s)].  To  compute  these  expected  values,  the  subproblem  solves  2^Xk  shortest 

path  problems,  one  for  each  possible  outcome  of  the  interdiction  plan  x . 

In  addition,  we  can  use  the  Benders  cut  for  building  the  integrality  and  covering 
cuts  in  the  usual  way  (see  Chapter  HI),  establishing  versions  of  Algorithm  2E,  the 
covering  decomposition,  and  Algorithm  3,  the  hybrid  algorithm,  for  solving  S-MXSP. 
An  important  part  of  those  two  algorithms  is  a  local-search  procedure  that  can  find  more 
than  one  covering  cut  per  iteration.  We  will  discuss  this  in  more  detail  later. 

A  major  difficulty  of  all  three  decomposition  algorithms  is  the  exponential 
complexity  of  the  subproblem.  For  instance,  if  an  interdiction  plan  interdicts  10  arcs,  the 
subproblem  requires  solution  of  1024  shortest-path  problems,  which  our  code  does  in  less 
than  2  CPU  seconds  (for  a  10  x  10  network).  An  average  of  2  seconds  CPU  time  for  the 
subproblem  is  not  a  major  concern.  But,  if  the  interdiction  plan  interdicts  20  arcs,  the 
running  time  of  the  subproblem  increases  to  over  2000  CPU  seconds  per  iteration!  Thus, 
the  subproblem  quickly  becomes  intractable. 
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C.         APPROXIMATION  THROUGH  DECOMPOSITION 

In  trying  to  cope  with  the  complexity  of  the  subproblem,  we  suggest  a  series  of 
approximation  algorithms  which  share  the  following  principles: 

(a)  There  is  no  change  in  the  master  problem;  either  one  of  the  three  decomposition 
master  problems  may  be  used.  But,  to  keep  the  discussion  simple,  we  assume  that 
the  master  problem  of  Algorithm  1  is  used. 

(b)  The  subproblem  solves  a  "reasonable  number"  of  shortest-path  problems. 

(c)  Given  an  interdiction  plan  x ,  the  subproblem  for  approximation  h,  sets  values  for 

c(x)  =  ch(x)  and  v^x)  =  v£(x)  such  that  [5-2]  holds,  i.e., 
z(x)<ch(x) +^v£(x)xk         Vx,xeX.  As        a        direct        result, 

zh  (x)  =  ch(x)+   2  vk(*)Xk  is  an  upper  bound  for  z(x). 

keA 

(d)  We  add  to  the  master  problem  for  approximation  h  the  valid  inequality,  or  "slack 
cut,"  z  <  ch(x)+  2  vj^  (x)jc^  .  We  call  that  a  "slack  cut"  because  [5-1]  may 

keA 

not  hold.  However,  since  [5-2]  holds,  the  value  of  the  objective  function  of  the 

master  problem,  denoted  by  z  for  approximation  h,  is  a  valid  upper  bound  for 
the  solution  of  S-MXSP.  We  may  also  add  to  the  master  problem  the  integrality 
cut  associated  with  this  slack  cut. 

(e)  For  a  given  master  problem,  we  define  zh  =maxzh(x).     We  use  zh   as  an 

xeX 

artificial,  possibly  invalid,  lower  bound  on  z(x*). 

(f)  When  the  difference  between  z  and  z  drops  below  a  designated  approximation 
gap,  we  say  that  "the  approximation  algorithm  has  converged." 
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(g)        The  algorithm  must  converge  because  the  number  of  feasible  interdiction  plans  is 
finite,  and  in  every  iteration  the  master  problem  either  suggests  a  new  interdiction 

plan  that  is  not  yet  in  X ,  or  z  h  =  zh . 
(h)        The  procedure  actually  solves  a  problem  with  a  modified  objective   zh(x). 

h 

Denote  by  x     the  optimal  (or  nearly  so)  solution  that  approximation  algorithm  h 
achieves  using  the  modified  objective, 
(i)         When  practical,  the  algorithms  establish  a  lower  bound  on  the  solution  of  S- 

MXSP  and  a  true  optimality  gap,  z    -z(x  ),  by  calculating  z(x   )  using  full 
enumeration.    When  this  is  impractical,  the  algorithms  estimate  z(x  )  through 

sampling.  (Any  other  algorithm  that  gives  a  lower  bound  on  z(x   )  could  be  used 
here,  too.) 

(j)         Last,  as  an  optional  step,  full  enumeration  of  z(x  )  can  be  used  to  tighten  the  cut 

in  the  master  problem  associated  with  x   ,  and  the  master  problem  can  be  re- 
solved. This  may  improve  the  upper  bound. 


To  establish  an  approximation  algorithm  as  described  above,  we  only  require  a 

subproblem  that  sets  values  for  c  (x)  and  v£(x)    such  that  [5-2]  holds.     Next,  we 

introduce  a  proposition  that  helps  us  to  derive  such  subproblems,  but  first  we  need  some 
definitions. 
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Definition  5.1:  A  deterministic  reply  strategy  y  (s)  for  the  network  user,  is  a  function 
that  assigns  an s-t  path  y  (s) ,  for  all  possible  outcomes  s  eS . 

The  deterministic  reply  strategy  represents  a  possible  way  of  action  for  the 
network  user.  Given  outcome  s,  the  reply  strategy  assumes  that  the  network  user 
traverses  path  y  (s) ,  independently  of  the  current  interdiction  plan.  This  is  a  feasible 
reply  but  the  network  user  may  have  better  choices.  Therefore,  for  every  interdiction  plan 
x,  the  average  shortest-path  length  achieved  by  y^s)  given  x,  is  an  upper  bound  on 
z(x) .  We  now  define  a  more  general  set  of  feasible  reply  strategies. 

Definition  5.2:  A  randomized  reply  strategy  y/l(s)  for  the  network  user  is  a  function  that 
assigns  a  probability  distribution  <j>(y  |  s),  over  the  set  of  all  s-t  paths  (denoted  by  y  e  Y ), 
for  all  possible  outcomes  se5.  (Thus,  ]T  <f>(y  |s)  =1  for  all  s  e  S. ) 

yA(s)   also  represents  a  possible  way  of  action  for  the  network  user.     Given 

outcome  s ,  the  randomized  reply  strategy  assumes  that  the  network  user  traverses  path  y 

with  probability  ^(y  |  s) ,  independently  of  the  current  interdiction  plan.    Note  that  any 

deterministic  reply  strategy  can  be  defined  as  a  randomized  reply  strategy,  too.  We  now 
show  formally  how  to  devise  a  slack  cut,  and  thus  an  approximation  algorithm,  from  any 
reply  strategy. 
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Proposition    5.2:       Let    y^(s)     be    a   randomized   reply   strategy   associated  with 


approximation  h.  Define. 


[5.5] 


[5.6] 


c*(x)     =^ckE 

keA 


yeY 


v*(x)   =^£ 


skHh(y\^yk 


yeY 


and 


VkzA 


Then,  [5-2]  holds,  i.e.,  z(x)  <  ch  (x)  +  £  v£  &)xk    V  x,  x  g  X. 

k<=A 


Proof:  For  all  x  e  X, 


z(x)      =  £ 


=  E 


mm  ^(ck+xkskdk)yk 


yeY 


keA 


minZ 


<E 


yer 


s 

Jte.4 


yeY 


keA\ 


(ck+xkskdk)Y,h(y\s)yk 

yeY 


=  TckE 


2>x(yls):y* 


keA         lyeY 
keA 


+  xkdkE  sk^<j>k(y\s)yk 
.   y*Y 


Corollary  5.1:  We  can  establish  an  approximation  algorithm  by  defining  how  a 
subproblem  sets  a  reply  strategy,  deterministic  or  randomized,  for  any  given  interdiction 
plan  x .  ■ 
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Thus,  in  the  approximation  algorithms  the  subproblem  takes  in  an  interdiction 
plan  x  and  returns  a  randomized  reply  strategy  y~(s)  or  a  deterministic  reply  strategy 

y^(s) .  In  the  exact  decomposition  algorithm  the  subproblem  does  the  same,  but  there  it 

finds  the  best  reply  strategy  (which  is  always  deterministic),  while  in  the  approximation 
algorithm  the  subproblem  finds  a  sub-optimal  strategy.  However,  in  order  for  the 
approximation  algorithm  to  work  effectively,  it  should  find  a  relatively  good  reply 
strategy  without  too  much  computational  effort.  We  next  describe  several  approximation 
algorithms,  each  one  characterized  by  its  reply  strategy. 

Algorithm  HI 

The  first  approximation  through  decomposition  uses  a  simple  expected- value 

approach.  Given  interdiction  plan  x,  let  y1(x)be  the  shortest  s-t  path  in  the  network 
using  expected  arc  lengths,  i.e.,  using  arc  lengths  ck  +  xkpkdk .  Now,  for  all  interdiction 

plans  x,  define  the  deterministic  reply  strategy  by  y^(s)  =  y1(x)   for  all  seS.    By 

Corollary  5.1  we  have  established  an  approximation  algorithm,  Algorithm  HI. 

The  modified  objective  in  HI  (see  principle  (h))  assumes  that  the  follower  knows 
the  chosen  interdiction  plan  and  all  success  probabilities,  but  not  the  actual  outcome  of 
the  executed  interdiction  plan.  This  "restricts  the  recourse"  of  the  follower  (see  Morton 
and  Wood  1999)  so  we  obtain  an  upper  bound  on  the  solution  for  S-MXSP,  as  we  already 
know,  from  Proposition  5.2. 
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In  this  approximation,  every  subproblem  solves  just  one  shortest-path  problem. 
Actually,  approximation  algorithm  HI  is  a  decomposition  for  the  deterministic 
interdiction  problem  with  dk  replaced  by  dkpk  =  dkEsk .    Therefore,  we  can  apply  the 

Algorithm  2E  or  Algorithm  3  with  the  Local_Search  procedure  established  for  the 
deterministic  case.  The  running  time  of  the  approximation  HI  (without  the  evaluation  of 
the  exact  objective  function  of  the  candidate  solution;  see  principle  (i)  above)  should  be 
roughly  the  same  as  the  running  time  for  the  deterministic  interdiction  algorithms. 

Algorithm  H2 

As  a  refinement  to  HI,  the  modified  objective  of  approximation  H2  assumes  that 
the  follower  knows  the  original  interdiction  plan,  all  success  probabilities  and  also  (and 
this  is  the  difference  between  HI  and  H2)  the  number  of  successful  interdictions. 
However,  the  follower  does  not  know  which  specific  arcs  were  interdicted  successfully. 

Given  an  interdiction  plan  x ,  let  n  be  the  number  of  interdiction  attempts.  For  m 

=  0,...,n,  p(m\x)  is  the  probability  that  x  results  in  m  successful  interdictions.  Let 
d™  =  E[skdk  \m,x\.  Hence,  ck  +xkdk  is  the  expected  length  of  arc  k  given  x  and  m. 
Let  y2'm(x)be  the  shortest  s-t  path  in  the  network  with  these  arc  lengths.  Now,  for  all 
interdiction  plans  x,  define  the  deterministic  reply  strategy  by  y^(s)  =  y2'm^s'x)(x)  for 
all  sg5  where  m(s,x)  if  the  number  of  successful  interdictions  x  causes  given  outcome 
s .  By  Corollary  5.1  we  have  established  an  approximation  algorithm  H2. 
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In  this  approximation,  every  subproblem  solves  just  n  shortest-path  problems. 
(Notice  that  v2'°(x)  is  the  shortest  s-t  path  with  no  interdiction,  which  is  independent  of 
x.)  However,  we  need  to  calculate  //m)(x)  and  d™ .    When  pk  =  p  for  every  k  eA, 
//m)(x)  can  be  calculated  directly  from  the  binomial  distribution,  and  the  fact  that 

TTl 

d™  - — dk.  When  different  arcs  may  have  different  probabilities /ty,  these  parameters 
n 

can      be      calculated      in      0{  \A  | 2 )      time      using      the      generating      function 

f(t)=Tl(ptt+a-pk)y 

keA 

Approximation  H2  partitions  the  probability  space  according  to  the  total  number 
of  successful  interdiction  attempts.  Other  partitioning  schemes  may  be  used  too.  For 
instance,  a  partition  can  be  based  on  the  success  of  a  single  interdiction,  or  on  the  number 
of  successes  in  a  group  of  arcs,  etc.  Furthermore,  an  algorithm  can  start  with  a  crude 
partition  and  refine  it  later,  until  it  reaches  a  desired  optimality  gap.  This  procedure  is 
called  "sequential  approximation"  in  the  stochastic  programming  literature  (e.g.  Kail  et  al 
1988)  and  it  was  used  by  Cormican  et  al.  (1998)  for  solving  a  stochastic  max-flow 
network-interdiction  problem.  Algorithm  H3  uses  yet  another  partitioning  scheme. 

Algorithm  H3 

In  this  algorithm,  the  subproblem  solves  the  shortest-path  problem  for  a  relatively 
few,  "most  likely"  outcomes,  and  bounds  the  shortest-path  length  at  all  other  possible 
outcomes,  using  the  simple  expected-value  approach.  Assume  for  instance  that  x 
interdicts  10  arcs  and  the  probability  of  success  is  0.8  for  every  arc.  Instead  of  solving 
1024  shortest-path  problems  (as  the  exact  decomposition  algorithm  would  do),   an 
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approximation  algorithm  H3  of  "enumeration  depth"  2  solves  only  the  cases  where  8 
(8  =  10-  2)  or  more  of  the  arcs  are  successfully  interdicted.  There  are  only  56  such 
outcomes  but  they  cover  about  68%  of  the  probability  space.  Then,  the  approximation 
bounds  the  shortest-path  length  in  the  remaining  968  outcomes  by  finding  one  shortest- 
path  which  is  optimal  with  respect  to  the  average  delays  across  those  outcomes. 

To  establish  approximation  H3  of  enumeration  depth  2  formally,  define  the 
following  sets: 

(a)  S'  is  the  set  of  all  outcomes  s  with  2  or  fewer  failures  in  x ,  and 

(b)  S"  is  the  set  of  all  outcomes  s  with  more  than  2  failures  in  x. 

Now,  for  all  interdiction  plans  x,  define  the  deterministic  reply  strategy  by 

y*(s)  =  y(x,s)  for  all  seS',  and  by  y*(s)  =  y3(x)  for  all  s  e S" ,  where  y3(x)  is  the 
shortest  path  with  arcs  lengths  defined  as  E[ck  +  xkskdk\  s  e  S"]  for  all  k  e  A . 

Example  5.1 

This  example  demonstrates  the  way  subproblems  work  in  the  exact  decomposition 
algorithm  and  in  the  three  approximations  suggested  so  far.  Moreover,  we  later  use  this 
example  to  motivate  a  possible  improvement  to  approximation  H3. 

Assume  that  the  interdictor  interdicts  4  arcs,  denoted  by  k\,  k2,  k3,  and  k4.  There 

are  24  =  16  possible  outcomes  and  each  is  denoted  by  a  four-digit  binary  number.  For 
instance,  1010  represents  an  outcome  in  which  the  interdiction  of  k\  and  k3  are 
successful  and  the  interdiction  of  k2  and  k4  are  not. 

All  the  algorithms  solve  several  shortest-path  problems,  each  associated  with  a 
specific  possible  outcomes,   or  an  average  of  several   outcomes  (combined  by   an 
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approximation  algorithm).  Figure  5.1  shows  how  the  different  algorithms  partition  these 
16  possibilities.  In  the  figure,  every  cell  represents  group  of  outcomes  that  the  algorithm 
links,  and  so  every  cell  represents  one  shortest-path  problem  that  the  subproblem  solves. 


Exact  Alg. 

Approx. 
Alg.  HI 

Approx. 
Alg.  H2 
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0001 
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Figure  5.1:  Given  an  interdiction  plan  with  4  attempts,  every  algorithm 
for  S-MXSP  partitions  the  16  possible  outcomes  into  a  different  set  of 
"cells"  (divided  by  horizontal  lines),  and  solves  one  shortest-path 
problem  for  each  cell. 
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Algorithm  H4 

In  approximation  H3,  the  reply  strategy  for  each  one  of  the  outcomes  in  S"  is  the 
same  path,  in  particular,  the  path  that  is  shortest  on  average  over  all  outcomes  in  S" .  (In 
the  example  of  Figure  5.1,  S"  is  the  large  cell  in  the  bottom  of  the  list  associated  with 
H3.)  The  main  idea  of  approximation  H4  is  to  use  information  about  shortest-path 
problems  associated  with  outcomes  in  S'  (in  the  example  of  Figure  5.1,  those  outcomes 
that  are  in  separate  cells  in  the  top  part  of  the  list  associated  with  H3)  to  define  a  possibly 
better  reply  strategy  for  outcomes  in  S" . 

For  instance,  consider  outcome  0100  in  Example  5.1.  Intuitively,  it  seems  likely 
that  shortest  paths  that  are  associated  with  outcomes  1100,  0110  and  0101  are  relatively 
short  paths  with  respect  to  outcome  0100.  Given  outcome  0100,  none  of  these  3  paths  is 
necessarily  the  shortest  path,  but  they  may  be  better,  i.e.,  shorter  on  average,  than  the 
single  path  that  is  good  on  average  with  respect  to  all  the  outcomes  in  S" .  In 
approximation  H4,  the  reply  strategy  for  each  of  the  outcomes  in  S"  (the  same  set  as  in 
H3)  is  a  randomized  combination  of  optimal  replies  to  related  outcomes  in  S' . 

To  define  precisely  approximation  H4  of  enumeration  depth  2,  we  first  assume 
that  pk  =  p  for  all  arcs  k.    Let  n  be  the  number  of  interdiction  attempts  for  a  given 

interdiction  plan  x.    For  m  =  0,...,n,  p^m\x)  is  the  probability  that  x  results  in  m 

successful  interdictions  (given  by  the  binomial  distribution),  and  Sm  (x)  is  the  set  of  all 
outcomes  with  exactly  m  successful  attempts  in  x .  Now,  given  an  interdiction  plan  x , 
we  define  the  randomized  reply  strategy  by  defining  <f>-  (y  I  s)  for  all  s  gS: 
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■>n-l/~\  ,   ,  c"~2 


(a)        For  all   SG5"(x)u5""1(x)u5n"z(x),  let    ^(y  s)    be   1   for  y(x,s)    and  0 


otherwise. 


(b)        For  m  =  0,...,n-3  and  all  seSm(x)  we  first  identify  the  (n2m)  elements  of 


-,«-2 


S      (x)     where    the    same    m     attempts    are    successful    too,    denoted    by 


,1   „2 


It) 


s  ,s  ,...,sv  "     .  (Out  of  the  n-m  interdiction  failures  in  x  corresponding  to 
s  e5m(x),  we  need  all  combinations  of  two  failures,  each  one  corresponding  to  a 


n-2, 


different  seS""z(x).)  Let, 


0i(y|s)H 


l/(B;m  y  ey^s1),^2),...,^1  2  J 


o 


otherwise 


By  Proposition  5.2  and  Corollary  5.1,  to  establish  an  approximation  algorithm 
the  subproblem  must  calculate    £[y^.(x,5)]    and    E[skyk(x,s)]    for  all    k&A.   The 

following  proposition  shows  how  that  can  be  done  with  respect  to  our  definitions  of 
approximation  H4. 

Proposition  5.3:  In  approximation  algorithm  H4  of  depth  2,  for  all  k  e  -A , 


[5.7]     E[yk(x~s)]       =    Sym\x)£[^(x,5)|sE5m(x)]+2ym)(x)£[^(x^) 


seSn_2(x) 


m=n-2 


m=0 


[5.8]     E[skyk(x,s)]     =   £/>(m)(x^i<  [^(x^)|s  eSm(x) 

m=n-2 


n-3 

+  ^p(m\x)E[sk\s  GSm(x)\E[yk(x,s)\s  GSn~2(x),sk  =1 

m=0 
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Proof:  By  definition,  for  all  k  e  A 


E\Sk&h]    =f,p(m)(x)E[yk(x,~s)\sGSm(x)]         and 


OT  =  0 


E[skyk(x,~s)]   =  £//m)(x)2<[^(x,s)|S  eSw(x) 

m=0 

and  so  it  is  enough  to  show  that  for  all  m<n-3  and  for  all  k  gA 


E 
E 


yk(x,~s)\seSm]       =E  yk(x,s)\s  eS*1"2]   and 


**?*(*»*) 


se5ffl      =E 


seSn-2(x),sk=l 


But,   these   are   straightforward  results   of  our   definition   of  the   reply   strategy  in 
approximation  algorithm  H4  of  depth  2  and  the  assumption  that  pk=  p  for  all  k  ■ 


Remark:  We  conjecture  that  a  modified  reply  strategy  can  be  defined  such  that 
Proposition  5.3  holds  even  if  the  probability  that  an  interdiction  attempt  is  successful  is 
not  the  same  for  all  interdictable  arcs.    That  modified  strategy  needs  to  assign  different 

weight  to  different  paths  in  the  definition  of  the  reply  strategy  for  s  e  Sm ,  m  <  n  -  3 ,  in 
order  to  keep  [5.7]  and  [5.8]  valid. 

In  order  to  calculate  Efj^x^)]  and  E[skyk(5t,s)]  for  all  k  eA  it  is  enough  to 

calculate  the  probability  of  each  outcome  s  e  Sn(x)  u  S"-1(x)  ^j  Sn~2(x) ,  and  to  find  the 
shortest-path  given  this  s,  since  for  all  k  eA  : 

(a)  5>(W)(*)  =  1-    I>(m)(x),and 

wj=0  m=n-2 

(b)  nf,p(mHx)E[sk\s  cSm(x)]  =  pk  -    fp(m)(^[i|s  e5m(x) 

nt=0  m=m-2 
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D.         A  LOCAL-SEARCH  PROCEDURE 

Our  experience  with  the  different  decomposition  algorithms  for  solving  the 
deterministic  MXSP,  as  well  as  preliminary  computational  results  for  S-MXSP  (reported 
later),  indicate  that  the  running  time  of  the  master  problem  is  very  sensitive  to  the  number 
of  Benders  cuts.  In  fact,  even  though  the  subproblem  of  S-MXSP  requires  more  work 
compared  to  the  subproblem  in  MXSP,  in  both  cases  the  limits  of  the  decomposition 
algorithms  are  determined  by  the  difficulty  in  solving  the  master  problems,  at  least  with 
our  current  technology. 

In  order  to  solve  the  problem  with  fewer  master  iterations  (every  iteration  adds 
one  more  Benders  cut),  the  hybrid  algorithm  can  use  a  local-search  procedure  to  generate 
more  than  one  covering  cut  per  iteration.  Those  cuts  are  added  to  the  master  problem, 
and  tighten  it.  This  discussion  suggests  that  a  local-search  procedure  may  also  be  helpful 
for  the  different  decomposition  algorithms  (exact  or  approximate)  for  S-MXSP.  We 
describe  a  possible  local-search  procedure  for  the  exact  decomposition  algorithm. 
However,  the  same  approach  may  be  use  to  develop  a  local-search  procedure  for  all  the 
approximation  algorithms,  too. 

Let  y$(s)  be  any  reply  strategy,  deterministic  or  randomized,  that  the  subproblem 

can  define  given  interdiction  plan  x .    It  may  be,  for  instance,  that  y^  (s)  is  the  second 

shortest  path  given  x  and  s ,  or  the  second  shortest  path  in  the  list  of  paths  generated  by 
our  Local_Search  procedure  we  described  for  MXSP.  Then,  by  Proposition  5.2  we  can 
define     c(x)-  ^E[cky(x,sk)]    and      vk(x)  =  dkE[skyk(x,s)],    to    obtain   the   valid 

keA 

Benders  cut  z  <  c(x)  +  ;T  v^x);^   But,  as  we  discussed  earlier,  too  many  Benders  cut  is 

keA 
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not  a  good  idea.  Therefore,  the  local-search  procedure  might  only  generate  a  covering 
cut  based  on  this  (slack)  Benders  cut,  and  add  it  to  the  master  problem.  (If  c(x)  exceeds 
the  current  value  of  z ,  we  will  not  include  this  cut  in  the  master  problem,  but  rather,  as  in 
Algorithm  2E  for  MXSP,  put  it  aside  for  possible  later  use.) 

For  instance,  suppose  we  choose  yk(x,s)  as  the  second  shortest  path  given  x  and 

s .  Then,  when  we  compute  the  exact  Benders  cut  we  also  find  the  second  shortest  path 
in  each  of  the  subproblems.  Those  second  shortest  paths  are  used  to  compute  a  slack  cut, 
and  the  covering  cut  associated  with  this  slack  cut  is  added  to  the  master  problem.  Note 
that  we  can  generate  more  than  one  slack  cut  per  iteration  by  finding  additional  paths  for 
every  subproblem. 

E.         COMPUTATIONAL  EXPERIENCE 

To  test  the  different  algorithms,  we  use  the  shortest-path  network  and 
computational  platform  described  in  Chapter  II.  However,  a  new  vector  p  is  added, 
where  pk  is  the  probability  an  interdiction  attempt  on  arc  k  is  successful.  For  the  results 
reported  here,  we  use  the  same  success  probability  for  every  arc,  denoted  hyp. 

The  following  tables  summarize  the  results  for  several  different  cases.  We  note 
that  these  are  preliminary  results  and  that  none  of  the  algorithms  includes  a  local-search 
procedure.  Thus,  the  exact  and  approximation  decompositions  are  accomplished  with 
Algorithm  1.  In  the  case  of  approximation  HI,  we  could  have  used  the  Local_Search 
procedure  developed  for  deterministic  network  interdiction  (that  might  have  reduced  its 
running  time  significantly,  as  seen  in  Chapter  II)  but  we  did  not,  in  order  to  allow  a  fair 
comparison  between  this  algorithm  and  the  others. 
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Table  5.1  compares  approximation  HI,  approximation  H2  and  the  exact 
algorithm.  In  both  approximations  we  use  a  1%  approximation  gap,  but,  as  the  table 
shows,  that  translates  to  a  12-20%  true  optimality  gap  for  our  test  problems.  (See 
principles  (f)  and  (i)  in  Section  5.C)  for  the  definitions  of  approximation  gap  and 
optimality  gap.) 

We  solve  the  same  problems  with  the  exact  algorithm  up  to  a  12%  or  15% 
optimality  gap.  Table  5.1  shows  that  the  exact  algorithm  has  similar  running  times  to  the 
approximations  for  this  parameter  setting.  But,  since  computational  effort  in  the  exact 
algorithm  is  clearly  more  sensitive  to  the  total  amount  of  interdiction  resource  (we  do  not 
see  this  in  the  table  because  ro  is  relatively  small),  the  approximation  algorithm  would 
probably  outperform  the  exact  algorithm  with  larger  values  of  tq.  In  any  case,  the 
running  times  indicate  that  we  cannot  successfully  increase  ro  significantly,  even  in  the 
approximations,  without  adding  a  local-search  procedure  or  other  effective  enhancement. 

H2  takes  much  more  running  time  than  HI,  but  yields  a  similar  optimality  gap. 
The  major  disadvantage  of  H2  is  in  the  master  problem  level  (the  extra  work  in  the 
subproblem  is  insignificant  here.)  The  cuts  in  the  master  problem  of  H2  are  less  effective 
(compare  the  number  of  iterations  the  two  algorithms  need  for  convergence,  Nh2  versus 
Nhi),  probably  because  every  cut  in  H2  represents  a  weighted  combination  of  multiple  s-t 
paths,  and  not  a  single  path.  Thus,  in  the  cuts  of  H2  the  non-zero  coefficients  are  smaller 
on  average,  and  so  the  cuts  are  "flatter,"  (in  the  geometric  sense)  compared  to  the  cuts  in 
HI.  (Notice  that  each  cut  in  the  exact  algorithm  is  a  weighted  combination  of  many  s-t 
paths  and  so  is  even  flatter.    As  a  result,  the  exact  algorithm  requires  more  iterations  to 
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achieve  a  12%  gap,  than  approximations  HI  and  H2  need  to  achieve  a  1%  approximation 
gap,  which  is  actually  1%  optimality  gap  with  respect  to  the  modified  objective.) 
Note  also  that: 

(a)  The  optimality  gap  of  both  approximations  HI  and  H2  becomes  smaller,  though 
not  small  enough,  when/?  increases,  and 

(b)  The  optimality  gap  of  all  approximations  increases  when  we  have  more 
interdiction  resource. 

(c)  For  the  case/?  =  0.7  and  ro  =  15  (problem  set  IS),  we  used  the  exact  algorithm  to 
solve  the  same  problem  to  a  2%  optimality  gap.  It  turns  out  that  the  optimality 
gap  obtained  by  the  approximation  algorithms  (and  the  exact  algorithm  when  used 
with  a  15%  gap)  depends  primarily  on  poor  upper  bounds  rather  than  poor 
interdiction  plans  x.  About  20%  of  the  gap  is  due  to  the  difference  between  the 
optimal  objective  value  and  the  lower  bound  (i.e.,  the  objective  value  of  the 
incumbent  solution),  while  the  weak  upper  bound  is  responsible  for  80%  of  the 
gap- 
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Approximation  HI 

Approximation  H2 

Exact  Algorithm 

Problem 

P 

ro 

LBHi 

UBH1  %gH1 

TH. 

NHi 

LBH2 

TJBH2    %gH2 

Th2 

Nh2 

LBE 

UBE    %gE      TE 

NE 

IS 

0.7 

15 

17.8 

21.0     18.3 

15 

20 

17.8 

20.8     16.5 

38 

33 

18.0 

20.6       15        14 

22 

2S 

0.7 

20 

18.4 

22.0    20.1 

84 

33 

18.4 

21.8    18.6 

243 

54 

18.5 

21.3       15       87 

37 

3S 

0.8 

15 

18.8 

21.2    12.6 

21 

24 

18.8 

21.1     12.3 

36 

21 

18.9 

21.0       12        39 

32 

4S 

0.8 

20 

19.5 

22.5     15.6 

102 

39 

19.5 

22.4     14.4 

266 

53 

19.5 

21.7       12      255 

60 

Table  5.1:  Computational  results  for  S-MXSP.  The  test  network  has  64=8x8  inner  nodes  (a=238),  c=10,  d=\0 
and  r=5.  The  approximation  gap  for  HI  and  H2  is  1%. 

Legend:  LBA  Lower  bound  achieved  by  Algorithm  h. 

XJBh  Upper  bound  achieved  by  Algorithm  h. 

%gh  True  optimality  gap  achieved  by  the  Algorithm  h. 

Th  Running  time  in  CPU  seconds  for  Algorithm  h. 

N/,  Number  of  iterations  for  Algorithm  h. 


Table  5.2  compares  approximation  H3,  approximation  H4  and  the  exact 
algorithm  (both  approximations  are  of  enumeration  depth  2).  We  solve  the  exact 
algorithm  with  5%  and  10%  optimality  gaps,  and  in  order  to  obtain  similar  results  we  set 
the  approximation  gap  to  1%  and  4%  in  H3,  and  to  4%  and  8%  in  H4. 

The  table  shows  that  approximation  H3  cannot  establish  small  optimality  gaps.  In 
problems  7S  we  solve  approximation  H3  with  a  1%  approximation  gap  but  obtain  an  8% 
true  optimality  gap.  On  the  same  problems,  approximation  H4  with  a  4%  approximation 
gap  yields  a  true  optimality  gap  of  6.5%.  Thus,  approximation  H4  estimates  the  reply  to 
outcomes  with  3  or  more  failures  better  than  approximation  H3,  and  so  the  modified 
objective  of  H4  is  closer  in  its  value  to  the  optimal  objective. 
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Table  5.2  also  demonstrates,  just  as  Table  5.1,  that  the  approximations  and  exact 
algorithm  have  similar  running  times,  when  the  exact  algorithm  is  solved  with  a  similar 
true  optimality  gap.  But,  with  increased  ro  the  approximations  would  probably 
outperform  the  exact  algorithm. 


Approximation 

H3 

Approximation 

H4 

Exact  Algorithm 

Prob. 

P 

n 

%g 

LBhs    UBm    %gro 
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Table  5.2:  Computational  results  for  S-MXSP.    The  test  network  has  64=8x8  inner  nodes  (o=238), 
c=10,  rf=10andr=5. 

Legend:    %g      Approximation  gap. 

All  other  legend  data  as  in  Table  5.1 
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CONCLUSIONS 


In  this  chapter  we  have  shown  how  our  approach  for  solving  deterministic 
system-interdiction  problems  can  be  extended  to  solve  one  type  of  stochastic  system- 
interdiction  problem.  We  revisited  the  shortest-path  network-interdiction  problem  to 
demonstrate  this,  but  this  time  assumed  that  interdiction  success  is  uncertain.  As 
expected,  the  stochastic  problem  is  much  more  difficult  to  solve  than  the  deterministic 
one,  mainly  because  the  subproblems  in  our  decomposition  algorithm  generate  "flat" 
cuts,  and  so  the  master  problem  requires  more  iterations  to  converge.  Surprisingly,  this  is 
even  true  for  an  exact  algorithm  with  exponential  complexity  in  the  subproblems.   From 
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our  experience  with  the  deterministic  interdiction  problem  (and  the  shortest-path 
network-defense  problem)  we  know  that  a  local-search  procedure  will  likely  accelerate 
the  decomposition  algorithms  for  the  stochastic  problems,  but  we  have  not  yet 
implemented  such  a  procedure. 

We  compared  the  exact  decomposition  algorithm  to  several  approximation 
(decomposition)  algorithms.  On  our  test  problems,  the  exact  and  approximation 
algorithms  require  similar  running  times  (when  the  problem  is  solved  to  the  same 
optimality  gap)  but  in  larger  problems  the  approximations  are  likely  to  be  better,  because 
they  don't  require  an  exponential  amount  of  work  in  the  subproblem  phase. 

Among  the  approximations,  algorithm  H4  gives  the  best  results.  For  a  given 
optimality  gap,  running  times  for  approximation  H4  are  similar  to  those  of  the  other 
approximations,  and  of  all  the  approximations  tested,  approximation  H4  establishes  the 
smallest  optimality  gaps.  Approximation  H4  finds  the  optimal  reply  of  the  network  user 
for  the  most  likely  outcomes  out  of  the  interdiction  attempts,  and  use  that  to  approximate 
(and  bound)  the  optimal  network  user  replies  for  all  other  outcomes. 

Last,  we  note  that  our  approach  for  solving  S-MXSP  can  be  easily  applied  to 
other  interdiction  problems,  where  the  success  of  each  interdiction  attempt  is  uncertain. 
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VI.  CONCLUSIONS 

This  chapter  reviews  the  accomplishments  of  this  dissertation  and  suggests 
opportunities  for  further  research. 

In  this  dissertation  we  have  discussed  several  problems  concerning  system 
interdiction  and  defense,  using  a  shortest-path  network-interdiction  scenario  to 
demonstrate  our  approach.  We  have  addressed  the  following  questions: 

(a)  What  is  the  best  interdiction  plan? 

(b)  What  is  the  best  defense  plan  against  a  prospective  set  of  interdictions? 

(c)  What  is  the  best  interdiction  plan  when  interdiction  attempts  might  fail? 

The  deterministic  shortest-path  network-interdiction  problem  (MXSP)  is 
discussed  in  Chapter  II.  MXSP  assumes  that  a  network  user  traverses  a  shortest  path 
given  the  results  of  a  prior  interdiction,  and  the  question  is  "What  interdiction  plan  will 
maximize  the  length  of  that  shortest  path?"  When  interdiction  of  an  arc  increases  its 
effective  length  by  a  finite  amount  (called  "delay"),  and  the  network  user  traverses  the 
shortest  path  given  the  interdiction,  we  have  shown  how  to  formulate  the  problem  as  a 
mixed-integer  program  (MTP),  and  how  to  solve  the  problem  with  Benders 
decomposition.  However,  when  interdiction  of  an  arc  makes  the  arc  impassable,  those 
solution  techniques  can  be  ineffective,  and  we  therefore  devised  a  second  decomposition 
algorithm,  in  which  the  Benders  master  problem  is  replaced  by  a  set-covering  problem. 
Last,  we  combined  the  first  two  decomposition  algorithms  into  a  hybrid  decomposition 
algorithm  which  gives  the  best  computational  results.  All  tests  were  performed  on 
randomly  generated  networks,  it  would  be  interesting  to  repeat  those  tests  on  more 
realistic  problems. 
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The  hybrid  algorithm  includes  several  special  enhancements,  derived  through  the 
first  two  decomposition  algorithms,  especially  (/')  integrality  cuts  for  the  Benders  master 
problem  along  with  a  method  to  tighten  those  cuts,  and,  (if)  covering  constraints — which 
are  best  viewed  as  integrality  cuts  in  this  context — and  a  method  to  generate  and  lift 
them.  Those  enhancements  were  shown  to  be  effective  for  solving  MXSP.  It  would  be 
interesting,  when  delays  are  finite,  to  see  if  the  integrality  cuts  and/or  covering 
constraints  derived  from  the  decompositions  would  be  useful  as  (integrality)  cuts  for 
reducing  solution  times  for  MXSP  solved  as  a  MIP.  It  might  also  be  possible  to  add 
some  constraints,  possibly  aggregated,  from  the  MIP  to  the  decomposition  master 
problems  to  tighten  their  relaxations  and  thereby  improve  solution  times. 

In  Chapter  HI  we  showed  how  the  techniques  used  to  solve  the  shortest-path 
network-interdiction  problem  can  be  used  for  solving  other  interdiction  problems  where 
an  interdictor  tries  to  reduce  the  effectiveness  of  an  adversary's  system  through 
interdiction.  Thus,  our  methods  can  be  used  to  interdict  a  shortest-path  system  with  side 
constraints,  disrupt  activities  in  a  PERT  network  in  order  to  maximize  project  completion 
time,  reduce  the  effectiveness  of  an  economic  system  modeled  as  an  optimization 
problem,  etc. 

In  a  wider  perspective,  the  special  enhancements  we  suggest  for  the  basic  master 
problem  in  Benders  decomposition,  i.e.,  the  integrality  and  covering  cuts,  may  be  helpful 
while  applying  Benders  decomposition  to  other  problems  with  binary  "complicating" 
variables.  Consider,  for  example,  a  problem  of  the  design  and  operation  of  a  production 
and  distribution  system.  These  problems  often  involve  (/')  "strategic  variables,"  which 
constitute  binary  decisions  over  facility  locations  and  other  issues  of  infrastructure,  and, 


-100- 


(if)  "operational  variables,"  usually  assumed  continuous.  A  common  way  of  solving 
those  problems  is  through  Benders  decomposition  (e.g.,  Brown  et  al.  1987),  where  the 
subproblem  is  a  (relatively  simple)  operational  problem  and  the  master  problem  deals 
with  the  binary  strategic  variables.  It  might  be  possible  to  improve  running  times  of  such 
decompositions  by  adding  the  integrality  cuts  and/or  covering  constraints  to  the  Benders 
master  problem,  as  was  done  with  MXSP. 

In  Chapter  IV  we  discussed  a  system-defense  problem  in  which  the  system  user 
can  defend  some  of  his  activities,  resources,  etc.,  against  prospective  interdiction.  The 
system-defense  problem  turns  out  to  be  a  system-interdiction  problem  in  itself,  where  the 
defender  interdicts  the  interdictor's  system.  This  view  leads  us  to  solve  the  problem  of 
defending  the  shortest  path  (in  this  problem  the  network  user  defends  some  of  the  arcs  in 
a  shortest-path  network  and  afterward  the  interdictor  finds  the  best  interdiction  plan  on 
the  undefended  arcs  of  the  network)  with  nested  decomposition  algorithms.  The 
algorithms  we  use  include  the  enhancements  developed  for  MXSP  (and  adapted  for  more 
general  system-interdiction  problems)  and  special  procedures  that  take  advantage  of  the 
structure  of  the  nested  decomposition.  It  would  be  interesting  and  challenging  to  apply 
the  nested  decomposition  algorithm  to  other  system-defense  problems,  too. 

In  Chapter  V  we  showed  how  our  approach  for  solving  deterministic  system- 
interdiction  problems  can  be  extended  to  solve  a  shortest-path  network-interdiction 
problem  where  interdiction  success  is  uncertain,  and  the  interdictor  wishes  to  maximizes 
the  average  length  of  the  post-interdiction  shortest  path.  Even  this  "simple"  stochastic 
scenario  is  much  more  difficult  to  solve  exactly  compared  to  the  deterministic  analog 
because  evaluating  the  expected  shortest-path  length,  given  an  interdiction  plan,  requires 
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exponential  work. 

To  deal  with  the  complexity  of  the  stochastic  problem  we  devised  several 
decomposition  algorithms  that  approximate  the  expected  length  of  the  shortest  path  after 
interdiction.  In  these  algorithms,  the  subproblems  involve  only  at  a  subset  of  the  possible 
outcomes,  or  aggregate  several  outcomes  together,  so  that  the  number  of  scenarios 
considered  by  the  subproblem  is  manageable.  Those  approximations  yield  upper  bounds 
on  the  optimal  objective  value.  A  lower  bound  can  be  found,  when  computationally 
feasible,  by  calculating  the  exact  objective  value  (i.e.,  by  considering  all  possible 
scenarios)  for  one  feasible  interdiction  plan.  A  good  feasible  interdiction  plan  (one  that  is 
likely  to  give  a  good  lower  bound)  is  often  suggested  by  the  near-exact  solution  of  the 
approximation. 

Our  limited  computational  experience  includes  only  the  basic  Benders 
decomposition  for  the  exact  and  approximating  algorithms.  Unfortunately,  the 
subproblems  for  any  of  these  algorithms  generate  "flat"  cuts,  and  such  cuts  cause  the 
master  problem  to  require  more  iterations  to  converge  compared  to  analogous 
deterministic  problems.  Our  computational  tests  show  that  all  algorithms  can  have  similar 
running  times  for  the  same  optimality  gap.  However,  with  increased  interdiction 
resources,  the  approximations  are  likely  to  outperform  the  exact  algorithm.  Further 
programming  work  is  needed  to  check  the  effectiveness  of  the  integrality  cuts  and  the 
other  basic  decomposition  algorithms  in  this  stochastic  scenario;  these  techniques  might 
help  compensate  for  the  problematic  flat  cuts. 
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Our  model  assumes  uncertainty  only  with  respect  to  the  success  of  each 
interdiction  attempt,  but  other  types  of  uncertainty  might  be  important  as  well.  For 
instance,  in  a  shortest-path  interdiction  problem,  the  interdictor  might  not  know  the  exact 
length  of  certain  arcs,  the  exact  location  of  the  source  and  target  nodes,  etc.  More  work  is 
needed  to  accommodate  these  variations  of  the  model. 

Among  the  approximation  algorithms,  of  special  interest  is  an  algorithm  that  finds 
the  shortest  paths  with  respect  to  the  most  likely  scenarios  and  uses  those  to  approximate 
(and  bound)  the  shortest  path  with  respect  to  all  other  outcomes.  This  algorithm  seems  to 
give  the  best  results  but  correctness  is  only  proven  for  the  case  in  which  all  arc 
interdiction-success  probabilities  are  equal. 

The  approximation  algorithms  take  advantage  of  the  special  structure  of  the 
stochastic  network-interdiction  problem,  in  particular,  the  fact  that  first-level  variables 
(interdiction  decisions)  affect  only  the  cost  of  the  second-level  activities.  (In  a  shortest 
path  problem  the  cost  of  traversing  an  arc  is  the  arc's  length).  However,  the  same 
structure  can  be  found  in  other  stochastic  programming  problems.  Consider  a  stochastic 
programming  problem  of  the  form 

max     £[/(*)] 

T 

where  /(x)  =  max      c  y 

yeY 

s.t.  ATy<d+Bx 
where  B  =  diag(b) .  For  instance,  this  might  be  a  production  problem  where: 


103 


(a)  The  variables  x  are  binary  decisions  regarding  which  markets  to  expand. 

(b)  The  demand  at  facility  j  is  the  original  demand  dj  plus  the  stochastic  result  of  the 

market  expansion  bjXj  .  (Xj ■  =  0  implies  no  change  in  market j.) 

(c)  All  other  parameters  (production  capabilities  and  costs,  shipping  costs,  etc.)  are 
deterministic. 

If  we  take  the  dual  of  the  inner  maximization,  we  obtain  a  max-min  problem  with  the 
same  structure  as  the  stochastic  system-interdiction  problems  we  have  solved.  Thus,  this 
problem  can  be  solved  with  the  approximation  algorithms  we  have  devised. 

This  thesis  contributes  mostly  to  the  areas  of  system  interdiction  and  defense,  but 
our  techniques  may  be  helpful  in  other  applications  solved  by  Benders  decomposition 
including  certain  stochastic-programming  problems.  Our  results  should  provide  ample 
opportunities  for  further  research  in  all  of  these  areas. 
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APPENDIX  A.  BI-LEVEL  LINEAR  PROGRAMMING 

The  system  interdiction  problem  is  a  min-max,  mixed  integer,  bi-level  linear 
program.  In  this  appendix  we  introduce  the  definitions  of  a  general  bi-level  linear 
problem  and  its  max-min  and  mixed-integer  variants.  The  focus  of  the  discussion  is  on 
existing  algorithms  for  bi-level  problems,  and  their  applicability  to  the  special  structure 
of  the  system  interdiction  problem. 

A.         BI-LEVEL  LINEAR  PROGRAMMING 

The  general  Bi-Level  Linear  Program  (BLLP)  has  attracted  much  attention  in  the 
last  30  years  (e.g.,  the  literature  survey  in  Vicente  and  Calamai  1994,  the  reviews  in  Ben- 
Ayed  1993,  and  Wen  and  Hsu  1991).  Many  algorithms  have  been  suggested  to  solve  the 
BLLP  and  the  model  has  been  applied  to  a  number  real-world  problems.  Nonlinear  cases 
are  treated  in  a  few  papers  (e.g.,  Falk  and  Liu  1995)  and  recently,  the  more  general  case, 
where  part  of  the  variables  are  set  as  a  function  of  the  others  through  any  type  of 
equilibrium  constraints,  is  explored  too  (Luo,  Pang  and  Ralph  1996). 

A  bi-level  program  considers  two  decision-makers,  or  players,  who  may  be 
competitive.  Each  player  controls  some  activities  and  wishes  to  optimize  his  objective 
function,  which  is  a  function  of  all  the  activities,  including  those  that  the  second  player 
controls.  The  problem  can  be  viewed  as  a  non-zero-sum  game  where  one  of  the  players, 
the  leader,  plays  first.  Due  to  common  constraints,  the  actions  of  the  leader  influence  the 
feasible  region  of  the  second  player,  the  follower.  In  his  turn,  the  follower  optimizes  his 
objective  function,  in  view  of  the  decisions  of  the  leader,  but  independent  of  the  leader's 
objective  function.  We  assume  perfect  information,  that  is,  the  leader  knows  the 
objective  function  and  the  constraints  of  the  follower  and  hence  can  predict  the  follower's 
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reaction  to  any  decision  he  makes. 

The  mathematical  programming  formulation  of  BLLP  is: 

[BL]  min  c,rx  +  c2ry 

xeX,yeY(x) 

where        X        =  {x\Dx<d,x> 0},  and 
Y(x)     =  {y|yeargmin   c3ry 

s.t.        ^y<b-fix 

y^o        } 

Note  that  there  is  no  need  for  a  term  like  c4rx  in  the  follower's  program  because 
x  is  a  parameter  there,  not  a  variable. 

Y(x)  is  called  the  follower's  rational  reaction  set.  It  is  assumed  that  Y(x)  is  non- 
empty for  all  xgX.  The  inducible  region  is  defined  as  IR  =  {  (x,y)  |  Dx  <  d,  x  >  0,  y  <= 
Y(x)  }.  With  this  notation,  we  can  rewrite  [BL]  as 

[BL1]  min{ c/x  +  c2ry  |(x,y)  eIR}. 

The  feasible  region  to  [BL1]  may  not  be  convex.  Therefore,  the  problem  can  be 
difficult  to  solve  and  may  have  local  optima.  However,  let  S  be  the  feasible  region  of 
[BL],  i.e.,  S  =  {  (x,y)  |  Dx  <  d,  Ay  +  Bx  <  b,  x  >  0,  y  >  0}.  Then,  there  is  a  solution  of 
the  problem  that  is  a  vertex  of  S  (Bard  1984).  As  we  shall  see,  many  algorithms  try  to 
take  advantage  of  that  result  by  performing  an  implicit  search  of  all  possible  solutions 
without  enumerating  all  extreme  points  of  S. 
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B.         THE  LINEAR  MIN-MAX  PROBLEM 

[LSIP]  without  the  binary  constraints  is  a  special  case  of  [BL]  with  q  =  0  and 

c2  =  -c3 .  It  is  also  referred  to  as  the  Linear  Min-Max  Problem  (LMN): 
[LMN]  min  cry 

xeX,yeY(x) 

where        X        =  {x\Dx<d,x> 0},  and 
Y(x)     ={y\Ay<b-Bx,y>0}. 

Remark:  In  [BL],  If  7(x)  is  not  always  a  singleton,  and  c2ry  might  not  have  the  same 
value  for  all  y  e  7(x),  then  a  solution  to  [BL]  may  not  exist  (Bard  1991).  However,  in 
[LMN],  Cj  =  0  and  so  c2ry  has  the  same  value  for  all  y  e  7(x).    Thus,  when  7(x)    is 

bounded  for  all  xgX,  an  optimal  bounded  solution  for  [LMN]  must  exist. 

LMN  is  equivalent  to  a  structured  quadratic  problem.  Hence,  any  nonlinear 
algorithm  is  a  candidate  solution  method.  However,  this  quadratic  objective  formulation 
is  non-convex  and  the  problem  is,  consequently,  difficult  to  solve.  To  see  the 
equivalence,  take  the  dual  of  the  follower's  problem  in  [LMN]  (w  are  the  dual  variables) 
to  obtain: 

[LMN1]  min     (b-Bx)rw  =  wrb- wr5x 

x,w 

s.t.  Dx  <  d 
ATw  >c 
x  >  0,  w  >  0. 


113 


C.  THE  BI-LEVEL  MIXED-INTEGER  PROBLEM 

The  problem  we  are  interested  in,  system  interdiction,  falls  into  the  category  of 
the  Bi-Level  Mixed  Integer  Program  (BLMIP).  Let  Sx  and  Sy  represent  the  binary,  and/or 
integer  and/or  non-negativity  restrictions  on  the  values  of  the  variables  x  and  y, 
respectively.  Then,  the  formulation  of  BLMIP  is  the  same  as  [BL]  except  that  xeSx 
replaces  x  >  0  and  yeSy  replaces  y  >  0 : 

[BLMIP]  min  Cirx  +  c2ry 

xeX,yeY(x) 

where        X        =  {x  \Dx  <  d,  x  zSx},  and 
Y(x)     ={y  |y  eargmin  c3ry 

s.t.        Ay<b-Bx 

yesY        } 

In  the  system  interdiction  scenario,  Sx  a  {0, 1 }"  while  Sycz-R"'  and  closed  (i.e., 
all  the  follower's  variables  are  continuous).  The  general  definition  of  BLMIP  is  more 
flexible,  however. 

D.  APPLICATIONS 

The  ability  of  the  BLLP  model  to  represent  decentralized  decision  processes, 
where  several  different  objective  functions  are  incorporated  simultaneously,  has  attracted 
practitioners  during  the  last  30  years.  However,  the  difficulty  in  solving  BLLP  constrains 
the  number  of  actual  applications  and  few  models  have  passed  beyond  theoretical 
formulation.  Furthermore,  in  a  recent  review  of  the  BLLP  literature,  it  is  stated  that  "the 
overwhelming  majority  of  real-world  problems  are  formulated  and  solved  as  single  level 
programs  even  when  they  are  virtually  bi-level  (Ben-Ayed  1993)." 
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Most  of  the  models  and  work  in  the  area  of  involve  BLLPs  with  economic 
interpretations  (Fortuny-Amat  and  McCarl  1981).  The  upper  level  (leader)  is  the 
government,  or  the  head  of  an  organization,  that  controls  resources,  or  policy  measures 
such  as  prices,  taxes  and  subsidies.  The  lower  level  (follower)  is  the  private  sector,  or  the 
lower  level  of  the  organization,  which  optimizes  its  own  objective  function,  after  the 
higher  level  sets  the  rules.  Actual  work  in  this  area  includes  agricultural  planning, 
regulation  of  the  oil  industry  and  the  imperfect  cartel  in  the  international  coal  market. 
For  a  list  of  references  see  Vicente  and  Calamai  (1994)  and  Ben-Ayed  (1993). 

The  BLLP  model  has  also  been  applied  to  network-design  problems  for 
transportation  and  communication  networks.  The  two-level  formulation  takes  into 
account  the  reaction  of  users  to  the  improvements  made  in  the  system  and  hence  can  lead 
to  a  better  plan  for  the  system  manager  (e.g.,  LeBlanc  and  Boyce  1986,  Ben-Ayed,  Boyce 
and  Blair  1988). 

As  one  might  expect,  military  models  involving  worst-case  analysis  through  max- 
min  formulations  were  popular  during  the  arms  race  (e.g.,  Bracken  and  McGill  1973). 
However,  the  models,  based  on  weapons  attrition  theory,  are  non-linear,  and  typically  the 
leader's  activities  do  not  change  the  follower's  feasible  region.  Therefore  the  solution 
approach  taken  there  is  not  applicable  to  LSEP. 

In  the  LMN  framework,  we  are  familiar  with  two  military-oriented  applications: 

(a)  Max-flow  network  interdiction  (e.g.,  Wood  1993). 

(b)  Shortest-path  network  interdiction  (Golden  1978,  Fulkerson  and  Harding  1977). 
In  Chapter  II  we  discuss  in  details  a  version  of  this  problem,  in  which 
interdiction  decisions  are  binary,  and  not  continuous,  variables. 
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E.         ALGORITHMS  FOR  LMN  AND  BLLP 

Currently,  few  algorithms  exist  that  take  advantage  of  the  special  structure  of 
LMN.  On  the  other  hand,  any  of  the  many  algorithms  that  were  suggested  for  BLLP  can 
be  used  to  solve  LMN  as  well  (Bard  and  Falk  1982).  These  algorithms  are  of  interest 
because: 

(a)  We  can  relax  the  binary  constraints  of  LSIP  if  all  the  extreme  points  of  the  leader's 
feasible  region  are  binary.  Thus,  in  some  cases,  an  algorithm  for  BLLP  (or  LMN) 
solves  LSIP  directly.  Also, 

(b)  As  we  shall  see  later,  most  of  the  existing  algorithms  for  mixed-integer  problems 
like  LSIP  incorporate  a  continuous-BLLP  algorithm  to  solve  sub-problems. 

Some  of  the  BLLP  algorithms  are  not  well-suited  to  solving  LMNs.  As  we  said 
earlier,  the  LMN  is  a  special  case  of  BLLP  with  c2  =  -c3  and  cx  =  0  .   The  correlation 

(in  the  usual  statistical  meaning)  between  c2   and  c3  is  therefore  -1  for  the  LMN. 

Significantly,  most  of  the  existing  algorithms  for  BLLP  are  positive  in  the  sense  that  the 
algorithm  works  best  when  there  is  a  strong  positive  correlation  between  c2  and  c3,  i.e., 

when  the  objective  functions  of  the  leader  and  the  follower  are  similar,  with  respect  to  the 
follower's  variables.  A  positive  algorithm  is  likely  to  have  poor  performance  when 
applied  to  LMN.  To  solve  LMN,  we  shall  use  a  non-positive  algorithm,  i.e.,  an  algorithm 
that  performs  well  when  there  is  a  strong  negative  correlation  between  c2  and  c3 . 

While  describing  the  existing  algorithms  for  LMN  and  BLLP  next,  we  classify 
each  one  as  positive  or  non-positive.  The  classification  is  based  on  algorithmic  structure 
and  is  by  no  means  precise,  but,  in  some  of  the  cases,  reported  computational  experience 
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also  supports  our  classification.  However,  unless  mentioned  specifically,  experience  with 
large  problems  has  not  been  reported. 

1.  Implicit  Enumeration  of  Possible  Bases 

Recall  that  S  is  the  joint  feasible  region  of  the  two  levels  in  [BL]  and  that  there  is 
an  optimal  solution  at  a  vertex  of  S.  A  few  algorithms  try  to  use  this  result  by  implicit 
enumeration  of  the  bases  of  the  polytope  that  defines  S.  Usually,  the  algorithm  starts  by 
letting  the  leader  control  all  the  variables  in  order  to  find  his  optimal  solution  over  the 
vertices  of  S,  regardless  of  the  follower's  objective.  Fixing  the  leader's  variables,  the 
algorithm  solves  the  follower's  problem  to  determine  if  the  solution  is  in  the  inducible 
region.  If  it  is,  we  have  reached  the  optimal  solution.  Otherwise,  we  can  conclude  that 
the  basis,  or  the  vertex,  that  the  leader  chose  is  not  optimal.  Several  approaches  have 
been  suggested  to  continue  the  search  over  6"s  vertices: 

(a)  A  branch-and-bound  process  can  be  used  where  each  new  branch  is  a  sub-problem 
with  one  of  the  basic  (and  positive)  variables  from  the  leader's  current  basis  forced  to 
0.  This  algorithm  was  originally  suggested  for  LMN  (Falk  1973). 

(b)  One  variant  examines  only  the  follower's  bases  (Candler  and  Townsley  1982). 
Strictly  speaking,  this  algorithm  is  polynomial  when  the  follower  controls  a  constant 
number  of  variables  (Liu  and  Spencer  1993),  but  it  becomes  computationally  unusable 
when  the  number  of  those  variables  grows  to  even  modest  levels. 

(c)  The  "Kth-best"  algorithm  (Bialas  and  Karwan  1982)  repeatedly  finds  solutions  for  the 
leader,  regardless  of  the  follower's  objective,  until  the  Kth  best  happens  to  be  in  the 
inducible  region. 

All  of  the  algorithms  just  mentioned  are  positive  algorithms  because  the  leader's 
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objective  is  favored  and  in  each  major  step  the  leader  controls  all  the  variables.  These 
algorithms  cannot  be  efficient  in  case  of  large  LMN  or  LSIP  problems. 

2.  Cutting-Plane  Algorithm  (Vaish  and  Shetty  1977) 

This  algorithm  works  on  the  [LMN1]  formulation.  First  it  iterates  (with 
appropriate  degeneracy-prevention  rules)  between  the  x  and  w  variables  until  a  stationary 
point,  that  may  only  be  only  locally  optimal,  is  achieved.  Then  it  computes  how  far  it  can 
move  from  the  extreme  point  in  any  feasible  direction  (with  respect  to  the  leader's 

variables)  without  improving  the  objective  function,  wrb  -  wr£x ,  cuts  this  part  from  X, 
and  starts  again.  This  algorithm  works  on  the  LMN  problem,  but  not  the  BLLP.  (BLLP 
doesn't  fit  into  formulation  [LMN1].)  Hence,  we  classify  it  as  a  non-positive  algorithm. 

3.  Branch-and-Bound  on  KKT  Complimentary  Conditions  (Bard  and 
Moore  1990) 

The  "BB-KKT  algorithm"  replaces  the  follower's  problem  with  his  KKT 
optimality  conditions.  This  way,  the  BLLP  is  converted  to  a  single-level  problem,  and  a 
branch-and-bound  procedure  is  used  to  implicitly  examine  all  combinations  of  the  non- 
linear complementary  slackness  conditions.  Let  w  be  the  vector  of  dual  variables 
associated  with  the  constraints  Ay  +  Bx<  b.  Then,  the  KKT-formulation  of  BLLP  is: 
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[BL2] 


min 
x,y,w 

T               T 

Cj  x  +  c2  y 

s.t. 

Dx 

<d 

Ay  +  Bx 

<b 

ATvf 

>c 

(^rw-c3)ry 

=  0 

(Ay  +  Bx-b)T 

w  =  0 

x>0,    y>0, 

w>0. 

Random  problems  with  40  constraints  and  100  variables,  40  of  them  controlled  by 
the  follower,  were  solved  by  Bard  and  Moore,  in  300  CPU  seconds  on  average,  on  an 
IBM  308 1-D.  The  main  factor  that  increases  the  CPU  time  is  the  number  of  variables 
controlled  by  the  follower.  This  result  is  expected  since  this  is  clearly  a  positive 
algorithm:  In  any  relaxed  iteration  of  the  branch-and-bound  process,  the  "BB-KKT" 
algorithm  controls  the  leader's  and  follower's  variables  together. 


4.  Penalty  on  Duality  Gap  (Anandalingam  and  White  1990) 

Here,  the  BLLP  is  transformed  into  a  single-level  program  by  replacing  the 
follower's  problem  with  a  penalty  on  his  duality  gap  (or  equivalently,  with  a  penalty  on 
the  complimentary  slackness  conditions  in  formulation  [BL2]).  The  reformulation  of 
BLLP  is: 
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[BL3]  min    c1rx  +  c27y-&(c37'y-  wr(b-  Bx)) 

x,y,w 


s.t. 

Dx                   <d 

Ay  +  Bx            <  b 

wTA                 >  c3 

x>0,y>0,w  >0. 

Let  the  optimal  solution  of  [BL3]  be  (x*,y*  w*).  x*  is  feasible  in  the  leader's 
problem.  Moreover,  for  k  sufficiently  large,  the  duality  gap  must  be  zero,  so  we  must 
have  y*e7(x*).  Two  different  algorithms  have  been  suggested  to  solve  [BL3]; 

Let     0(w)  =  minfc/x  +  c2ry  -  k(c3Ty  -  wr(b  -  Bx))  \Dx  <  d,Ay  +  Bx  <  b,x  > 
*>y 

0,y  >  0}  then,  [BL3]  is  equivalent  to  min{#(w)  \wTA  >  c3,w  >  0},  which  is  a  difficult 

w 

concave  minimization  problem.  Anandalingam  and  Apprey  (1991)  solves  this  problem 
with  a  successive  underestimation  method  proposed  by  Falk  and  Hoffman  (1976). 

A  second  way  to  solve  [BL3]  is  through  a  "modified  simplex  algorithm"  (Onal 
1993),  which  is  a  quadratic  programming  algorithm  (Beale  1959)  that  seems  to  become 
simpler  in  the  special  setting  of  [BL3].  The  algorithm  maintains  a  basic  feasible  solution 
and,  in  each  "simplex"  iteration,  it  evaluates  the  partial  derivatives  of  the  objective 
function  with  respect  to  the  non-basic  variables  (through  a  relatively  complex  matrix 
calculation).  Then,  it  pivots  and  chooses  the  entering  variable  in  the  usual  way.  In  each 
major  iteration,  a  local  optimum  might  be  found,  and  upper  bound  (UB)  is  updated  and  a 

cut,  c^x  +  c2ry  ^  UB-  s ,  is  added  to  the  problem.    The  problem  is  re-solved  until  no 
feasible  solution  is  found;  then  we  have  an  e-optimal  global,  solution. 
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It  is  not  clear  whether  these  two  algorithms  should  be  classified  as  positive  or  non- 
positive.  In  both  algorithms,  the  primal  variables  of  the  leader  and  the  follower  are 
controlled  simultaneously,  and  this  is  a  positive  approach.  However,  both  algorithms 
have  a  "correction"  step  where  only  the  follower's  dual  variables  are  considered.  That 
might  be  considered  as  a  follower's  step. 

5.  Complementarity  Approach  (Judice  and  Faustino  1992) 

The  idea  of  transforming  formulation  [BL2]  into  a  parametric  linear 
complementarity  problem  was  suggested  by  Bialas  and  Karwan  (1984)  but  their 
algorithm  isn't  guaranteed  to  converge  to  an  optimal  solution  (Ben-ayed  and  Blair  1990). 
In  1988,  Judice  and  Faustino  suggested  a  modification  that  is  guaranteed  to  converge  to 
an  e-optimal  solution.  The  algorithm  was  tested  on  random  problems  with  up  to  150 
constraints  and  250  variables,  and  was  shown  to  have  relatively  good  performance 
(Hansen,  Jaumard  and  Savard  1992).  However,  the  performance  of  the  algorithm 
degrades  significantly  when  tested  on  problems  with  "conflicting"  objectives.  This  is  a 
clear  evidence  that  the  algorithm  is  positive. 

6.  Variable  Elimination  (Hansen,  Jaumard  and  Savard  1992) 

This  algorithm  performs  branch-and-bound  on  the  constraints  of  the  follower's 
problem.  At  each  node  on  the  enumeration  tree,  one  more  of  these  constraints  is  forced 
to  bind  and  one  of  the  follower's  variables  is  eliminated.  Then,  the  algorithm  lets  the 
leader  control  the  follower's  remaining  unfixed  variables  and  the  leader's  problem  is 
solved  to  obtain  a  local  lower  bound  on  the  leader's  optimal  solution.  This  local  bound 
may  not  be  global  because  some  of  the  follower's  variables  have  already  been  set.  If  this 
local  lower  bound  is  worse  than  the  bound  from  a  feasible  solution,  this  node  can  be 
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eliminated.  The  algorithm  is  implemented  using  a  depth-first  search  of  the  enumeration 
tree  and  each  time  the  search  reaches  a  leaf  (all  follower's  variables  are  set),  the  leader's 
problem  is  solved,  a  feasible  solution  is  exposed  and  the  global  upper  bound  on  the 
follower's  optimal  solution  is  updated,  if  appropriate. 

The  algorithm  was  extensively  tested  on  problems  with  up  to  150  constraints  and 
250  variables.  It  was  shown  to  be  much  better  than  any  other  tested  algorithm,  including 
branch-and-bound  on  the  KKT  complimentary  conditions  (Bard  and  Moore  1990)  and  the 
Judice-Faustino  algorithm.  However,  like  those  two  algorithms,  certain  random 
problems  require  ten  times  more  computational  effort  than  other  problems,  and  sensitivity 
to  the  number  of  follower  variables  is  observed.  Furthermore,  a  special  set  of  tests 
indicates  that  the  running  time  decreases  when  the  leader's  and  follower's  objective 
functions  become  more  similar.  Those  results  indicate  that  this  is  a  positive  algorithm. 
Indeed,  the  lower  bound  on  the  follower's  objective  used  for  fathoming  will  rarely  be 
effective  in  the  min-max  case. 

7.  A  Hybrid  Tabu-Ascent  Heuristic  (Gendreau,  Marcotte  and  Savard 
1996). 

This  algorithm  attempts  to  solve  BLLP  to  near-optimal  ity  by  a  combination  of  a 
few  heuristic  methods.  After  a  feasible  solution  is  found,  the  algorithm  iterates  between  a 
local-ascent  search  and  a  tabu  search.  The  first  technique  is  used  to  find  an  optimum  that 
might  be  local,  and  the  second  is  used  to  move  away  from  a  local  optimum,  to  an  area 
where  a  solution  better  than  the  last  local  optimum  may  exist.  When  the  tabu  search  fails 
to  find  such  an  area,  the  algorithm  stops. 
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The  algorithm  was  tested  and  compared  to  the  variable  elimination  algorithm  on  a 
set  of  random  problems,  on  an  HP730  workstation.  The  largest  problems  had  200 
variables,  75  constraints  and  a  relatively  dense  constraint  matrix  (25%  non-zero).  On 
those  problems,  the  heuristic  algorithm  used  3-13  minutes  of  CPU  time  and  found  better 
solutions  than  the  exact  algorithm  found  after  60  minutes  of  CPU  time. 

Recall  that  the  variable  elimination  algorithm  has  significant  variation  in  running 
time  between  problems  of  the  same  size,  probably  because  it  is  a  positive  algorithm.  The 
heuristic  algorithm  has  a  much  more  stable  running  time.  Hence,  we  can  guess  that  the 
heuristic  is  using  a  non-positive  approach. 

F.         ALGORITHMS  FOR  THE  BLMTP 

Only  a  few  papers  have  been  written  concerning  solution  procedures  for  the  bi- 
level  mixed  integer  programming  (BLMTP). 

1.  Parameterized  integer  program  (Bard  and  Moore  1992) 

The  algorithm  works  only  when  both  x  and  y  are  binary.  It  works  by  solving 
instances  of  the  following  formulation 

[BLMTP1]        max    c3ry 

s.t.      Dx  <d 

Ay  +  Bx        <  b 

c1rx  +  c2ry  ^  a 
xeX,yeY 

where  a  is  a  parameter,  equal  to  the  best  objective  value  found  so  far  less  1.  (It  is 
assumed  that  all  objective  coefficients  are  integer.) 
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The  algorithm  implicitly  enumerates  the  enumeration  tree  associated  with  the 
variables  x.  In  each  iteration,  some  of  those  variables  are  set  to  0  or  1  and  the  remaining 
problem  is  solved  as  a  standard  MIP.  When  the  MTP  is  infeasible,  the  branch  is  deleted. 
Otherwise,  x  is  fixed  and  the  follower's  problem  is  solved  to  obtain  a  feasible  solution  to 
the  original  problem,  [BLMIP].  If  the  two  solutions  are  the  same,  there  is  no  need  to 
develop  this  branch  anymore.  Otherwise  the  enumeration  process  continues  by 
restricting  x  further.  The  algorithm  uses  specific  branching  and  backtracking  rules  that 
were  optimized  with  respect  to  a  set  of  random  problems. 

Computational  results  with  random  problems  with  up  to  45  binary  variables  were 
reported.  On  average  it  took  100-150  CPU  seconds  on  an  IBM  3081-D  to  solve  problems 
with  30  x  variables  and  15  y  variables.  Wide  variations  in  the  algorithm's  running  time 
and  sensitivity  to  the  number  of  variables  under  the  follower's  control  were  observed. 
Both  these  results  are  probably  because  this  is  a  positive  algorithm.  If  we  substitute  the 
LSIP  conditions,  c1  =  0  and  c3  =  -c  ,  then  [BLMI1]  would  become  almost  useless  and 
the  algorithm  might  enumerate  all  possible  values  for  x. 

2.  "Classical"  branch-and-bound  (Moore  and  Bard  1990) 

The  algorithm  solves  the  mixed  integer  bi-level  program  similar  to  the  way 
branch-and-bound  is  used  to  solve  MTPs.  At  every  node,  a  relaxed  BLLP  is  solved  and 
the  enumeration  tree  is  developed  and  fathomed  with  appropriate  fathoming  rules.  When 
all  the  leader's  variables  are  continuous,  as  in  LSIP,  the  three  "regular"  fathoming  rules 
(infeasiblity,  new  integer  solution  and  objective  value  worse  then  a  known  integer 
solution)  are  valid  and  used  in  the  usual  way.  When  all  or  part  of  the  follower's  variables 
are  restricted  to  integer  values,  the  fathoming  rules  must  be  modified,  however. 
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This  algorithm' s  performance  hinges  on  the  sub-algorithm  that  is  used  to  solve  the 
relaxed  BLLP  problems  (which  are  NP-hard.)  Originally  the  algorithm  was  implemented 
with  the  "BB-KKT  algorithm",  which  is  positive,  and  not  appropriate  for  solving  LSIP. 
The  algorithm  could  work  with  other  sub-algorithms  as  well,  but,  recall  that  we  have 
found  no  non-positive  algorithm  for  BLLP  that  has  been  tested  on  large  problems. 

3.  Binary  search  algorithm  (Wen  and  Yang  1990) 

As  in  LSIP,  this  algorithm  assumes  binary  leader  variables  and  continuous 
follower  variables.  However,  the  algorithm  doesn't  assume  the  min-max  case,  and 
allows  independent  objective  functions  for  the  leader  and  the  follower. 

The  algorithm  implicitly  examines  all  possible  values  of  the  leader's  variables 
through  a  branch-and-bound  process.  At  each  node  in  the  enumeration  tree,  a  few  of  the 
leader's  variables  are  set  to  0  or  1  and  the  algorithm  uses  an  LP  (which  we  won't  describe 
here)  to  calculate  a  local  lower  bound  on  the  leader's  objective.  This  branch  is  fathomed 
if  the  bound  is  worse  than  the  best  solution  value  found  so  far.  When  all  the  variables  x 
have  been  set  to  0  or  1,  the  follower's  problem  is  solved  to  obtain  a  new  feasible  solution. 

The  algorithm  is  positive,  and  when  it's  applied  to  a  problem  such  as  system 
interdiction,  the  lower  bound  from  the  LP  will  not  be  useful  at  all.  Thus,  the  algorithm 
might  enumerate  all  possible  values  for  x.  Moreover,  even  on  random  problems  the 
algorithm's  performance  is  poor  and  the  authors  suggest  using  a  heuristic,  which  we 
describe  next. 
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4.  Greedy  Heuristic  (Wen  and  Yang,  1990) 

This  heuristic  uses  a  greedy  approach.  At  each  iteration,  a  few  of  the  leader's 
variables  are  set  to  1  and  the  follower's  problem  is  solved,  as  well  as  the  LP  mentioned 
above.  Based  on  the  dual  variables  of  these  solutions,  a  "judgment  index"  for  the  profit 
of  the  leader  from  setting  each  one  of  his  variables  to  1  is  calculated.  The  variable  with 
the  maximum  judgment  index  is  set  to  1.  The  algorithm  starts  with  all  the  variables  equal 
to  0.  In  each  iteration,  it  sets  one  more  variable  to  1,  and  continues  until  no  more 
variables  can  be  set  without  violating  feasibility.  The  heuristic  is  extremely  fast  and,  on 
average,  achieves  better  than  a  3%  optimality  gap  when  tested  on  random  problems. 
However,  it  is  easy  to  build  an  example  where  this  simple  greedy  heuristic  will  give 
arbitrarily  bad  results. 

The  heuristic  becomes  simpler  when  it  applied  to  LSIP.  In  every  iteration,  the 
follower's  problem  is  solved  with  the  current  set  of  interdicted  activities,  the  "judgment 
index"  of  interdicting  activity  j  is  Uj  times  the  dual  variable  of  the  constraint^  <  Uj.  The 
activity  with  the  largest  judgement  index  is  interdicted,  and  the  process  continuous 
recursively. 

5.  Reducing  into  BLLP  (Vicente,  Savard  and  Judice  1996) 

The  last  algorithm  suggested  so  far  for  solving  BLMIP  transforms  the  problem 
into  a  regular  BLLP.  It  is  shown  that  if  (a)  y  is  continuous,  (b)  x  is  binary,  (c)  M  is 
sufficiently  large,  and,  (d)  cx  <  0  and  c2  ^  0  (without  loss  of  generality),  then  [BLMIP] 
is  equivalent  to: 
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[BLMIP2]  min  Cirx  +  c2ry +  Merw 

xeX,(y,w)eYW(x) 

where  X  =  {x  \Dx  <  d,  0  <  x  <  e} 

iw(x)  =  {(y,w)  |(y,w)  eargmax      c3ry  +  erw 

s.t.       Ay<b-Bx 
w    <  x 
w    <  e-x 

y    ey         } 

where  e  is  a  vector  of  ones  with  appropriate  dimension. 

As  with  other  models  using  penalty  terms,  a  key  problem  is  to  determine  how 
large  M  should  be.  Vicente  et  al.  suggest  solving  a  sequence  of  BLLPs  for  increasing 
values  of  the  penalty  term.  When  the  optimal  solution  in  the  kth  iteration  has  all  leader 
variables  at  0  or  1  we  can  stop  and  declare  optimality.  Otherwise  M  =  Mk  is  increased  to 

Mk+1  =  (-clTxk  -c2Tyic)/eTwk. ,   and  the  non-integer  optimal   solution   of  the  £th 

iteration  will  give  a  positive  and  unattractive  objective  in  the  following  iteration. 
Computational  experience  has  not  been  reported  and  it  is  not  clear  whether  computational 
difficulties  are  expected  (due  to  the  large  penalty  multiplier). 

G.        CONCLUSIONS 

The  main  conclusion  of  this  appendix  is  that  the  existing  literature  on  general 
BLLPs  does  not  suggest  suitable  algorithms  for  the  special  structure  of  LSIP.     We 
support  this  statement  with  the  following  observations: 
(a)        Only  three  exact  algorithms  (Bard  and  Moore  1990,  Hansen,  Jaumard  and  Savard 

1992,  Section  16.3.3  in  Shimizu,  Ishizuka  and  Bard  1997)  have  been  tested  on 
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relatively  large  BLLPs.  These  algorithms  all  use  a  strongly  positive  approach, 
which  means  that  they  work  better  when  there  is  strong  correlation  between  the 
leader's  and  follower's  objective  functions.  Hence,  they  would  probably  not  be 
efficient  when  applied  to  min-max  problems,  like  LSIP.  Only  a  few  exact 
algorithms  (Vaish  and  Shetty  1977,  Anandalingam  and  Apprey  1991,  Onal,  1993) 
that  may  use  a  non-positive  approach  exist,  and  none  of  those  has  been  tested  on 
large  problems. 

(b)  Existing  algorithms  for  the  mixed  integer  case,  BLMEP,  are  either  positive  by 
themselves  (Bard  and  Moore  1992,  Wen  and  Yang  1990)  or  are  based  on  a  BLLP 
algorithm  as  a  subroutine  (Moore  and  Bard  1989,  Vicente,  Savard  and  Judice 
1996).  And,  as  mentioned  above,  there  are  no  BLLP  algorithms  that  seem  to  be 
attractive  for  solving  LSIP. 

(c)  None  of  the  existing  algorithms,  exact  or  heuristic,  is  designed  to  take  advantage 
of  the  special  min-max  structure  of  LSIP.  Moreover,  the  algorithms  have 
typically  been  tested  on  "random  problems." 

We  have  established  that  none  of  the  existing  algorithms  for  BLLPs  or  BLMTPs  is 
really  appropriate  for  LSIP.  Therefore,  in  Chapters  II  and  Chapter  HI,  we  develop 
three  new  algorithms  specially  tailored  to  LSIP.  The  algorithms  definitely  exploit  the 
special  structure  of  LSIP  and  cannot  be  applied  to  a  general  BLMIP.  In  Chapter  n,  we 
demonstrate  the  effectiveness  of  the  algorithms  on  a  special-case  problem,  shortest-path 
network  interdiction. 
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APPENDIX  B:  THE  MORE  GENERAL  SYSTEM  INTERDICTION  PROBLEM 

Proposition  3.1:  When  Assumption  3.1  holds,  the  basic  linear  system  interdiction 

[LSIP]         min       max      cry 

xeX        yeY(x) 

where  X      =  jx  e  {04}"  |  R*  <  r},  and 

Y(x)  =  {y|,4y<b,0<y<t/(l-x),yeS} 

is  equivalent  to  the  more  general  linear  system-interdiction  problem  defined  as 
[LSIP*]       min        max      cry-xrVy 

xeX        ye7(x) 

where  X       =[x  e{0,l}"  ^x  <  r},  and 

Y(x)  =[y  eR*\Ay  <b-Bx,0<y,y  eS] 

where    f/=diag(u),    S  and  S    include   integer  or  binary  restrictions  on   elements   of 

y  and y respectively,  A  eRkxm ,V  gR^"1  ,A  eRkxA  andBeR^*". 
Remarks: 

(a)  The  general  case,  [LSIP*],  allows  an  interdiction  by  the  leader  to  affect  one  or 
more  of  the  follower's  available  resources  and/or  the  availability  and  cost  of  the 
follower's  possible  activities. 

(b)  The   restriction   that    B»  >  0    is   acceptable,    because   it   is   unlikely   that   an 

interdiction  will  relax  any  of  the  system's  constraints. 
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Proof: 


Set  A  = 


A 

,  b  = 

b 

,  B  = 

0 

I 

u 

B 

and  V  =  [0] .  Then,  [LSIP]  takes  the  form  of 


[LSIP*]. 

For  the  second  direction,  we  first  show  how  to  drop  out  the  non-linear  term  in  the 

objective  function  of  [LSIP*].    Let  us  introduce  n  new  variables,  y  &R+,  and  n  new 


constraints,     y  >  Vy  -  V(l  -  x).     Set    y  = 


"y" 

,    c  = 

c 

,    b  = 

b 

,     A  = 

A 

o" 

_y_ 

-1 

VI 

V 

-/ 

B  = 


,  and  V  =  [0] .    These  new  constraints  and  the  unattractive  coefficients  of  y  in 


the  objective  function,  guarantee  that  v;-  =  ^Fi(Vy)j    if  Xj  =  1  (recall  that  V,ei?Jxm). 


*j=1 


Therefore,  for  every  xel  the  solution  of  the  inner  maximization  problem  stays  the 
same,  and  so  this  transformation  doesn't  change  the  optimal  solution.  We  conclude  that 
we  can  assume  that  V  =  [0] . 

We  now  show  how  to  rearrange  the  structure  of  the  constraints  in  Y(x) .  Let  us 

introduce  (kxn  +  n)  new  variables,  z  e  R+  and  y  €  R  .  (Note  that  z  is  a  vector,  not 
a  matrix.)  We  add  the  following  constraints:  (a)  y  <  1  - x,  and  (b)  Z«_n^+j  ^  Btj (1  - Jj) 

for  i=l,..,k   and  j=\,..,h .  (For  simplicity  we  denote  Z^u^+j  by  z^  .) 

m  h 

„  ^  **  ^. 

To  finish  the  construction,  the  original  yth  constraint,   /.Ajtyi  ^  &,  -  2^y*./' »  ^s 
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replaced  by  zLA^yt  <  bj  -  2^Zy  .  This  replacement  changes  nothing,  because: 

7=1  j-1 

(a)  If  activity  j  is  interdicted  (Xj  =  1),  then  these  constraints  and  construction  set 
Jj  =  0  and  therefore  ztj  >  Btj  for  /'.  However,  for  every  interdiction  plan  x,  there 

is  an  optimal  solution  with  Zy  =  5y-  for  all  /,  because  z  only  tightens  constraints. 

(b)  In  the  same  way,  when  activity  j  is  not  interdicted  (x,  =  0),  for  every  interdiction 
plan  x,  there  is  an  optimal  solution  with  zy  =  0  for  all  i. 

It  is  easy  to  verify  that  the  new  construction  fits  into  formulation  [LSIP],  where 
y,  y ,  and  z  are  aggregated  into  y,  and  A,  U,  and  b,  are  defined  appropriately.  ■ 
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